@async-atharv/ipaship (>=1.2.1 <=1.2.2), @bentwnghk/chat (>=1.85.2 <=1.107.2) +94 more potentially affected by CVE-2025-53548 via @clerk/backend (>=2.0.0 <=2.33.5)

@clerk/backend NPM version =2.0.0, =1.2.1, =1.85.2, =0.0.1, =3.0.3, =0.1.0, =2.8.0-snapshot.v20250514155045, =1.5.0-snapshot.v20250514155045, =2.3.0, =6.20.0-snapshot.v20250514155045, =1.7.0, =1.5.0, =4.8.0, =0.16.0, =1.7.0-snapshot.v20250514155045, =1.0.4, =1.0.7 and more Source cves:...

CVE-2024-57068

A prototype pollution in the lib.mutateMergeDeep function of @tanstack/form-core v0.35.0 allows attackers to cause a Denial of Service DoS via supplying a crafted payload...

@account-kit/react (>=4.0.0 <=4.88.4), @account-kit/react-native (>=4.15.0 <=4.88.4) +50 more potentially affected by CVE-2024-57068 via @tanstack/form-core (>=0.0.1 <=0.42.0)

@tanstack/form-core NPM version =0.0.1, =4.0.0, =4.15.0, =3.13.0, =0.0.1, =0.1.1, =0.0.1, =1.0.0, =0.3.5, =0.3.3, =4.0.0 and more Source cves: CVE-2024-57068 Source advisory: OSV:GHSA-GGV3-VMGW-XV2Q...

GHSA-GGV3-VMGW-XV2Q @tanstack/form-core prototype pollution

A prototype pollution in the lib.mutateMergeDeep function of @tanstack/form-core v0.35.0 allows attackers to cause a Denial of Service DoS via supplying a crafted payload...

CVE-2024-57068

A prototype pollution in the lib.mutateMergeDeep function of @tanstack/form-core v0.35.0 allows attackers to cause a Denial of Service DoS via supplying a crafted payload...

CVE-2024-24558

TanStack Query supplies asynchronous state management, server-state utilities and data fetching for the web. The @tanstack/react-query-next-experimental NPM package is vulnerable to a cross-site scripting vulnerability. To exploit this, an attacker would need to either inject malicious input or...

CVE-2024-57068

A prototype pollution in the lib.mutateMergeDeep function of @tanstack/form-core v0.35.0 allows attackers to cause a Denial of Service DoS via supplying a crafted payload...

CVE-2024-57068

Prototype pollution in @tanstack/form-core lib.mutateMergeDeep (v0.35.0) allows crafted payloads to trigger a DoS. PoC exists per connected sources; no patch/version remediation details provided in the documents. Affected: core library function; root cause: unsafe object property handling leading...

CVE-2024-57068

A prototype pollution in the lib.mutateMergeDeep function of @tanstack/form-core v0.35.0 allows attackers to cause a Denial of Service DoS via supplying a crafted payload...

form 安全漏洞

form is an open source form state management program from TanStack. A security vulnerability exists in form version v0.35.0, which stems from the lib.mutateMergeDeep function containing a prototype contamination vulnerability...

CVE-2024-24558

TanStack Query supplies asynchronous state management, server-state utilities and data fetching for the web. The @tanstack/react-query-next-experimental NPM package is vulnerable to a cross-site scripting vulnerability. To exploit this, an attacker would need to either inject malicious input or...

Cross site scripting

TanStack Query supplies asynchronous state management, server-state utilities and data fetching for the web. The @tanstack/react-query-next-experimental NPM package is vulnerable to a cross-site scripting vulnerability. To exploit this, an attacker would need to either inject malicious input or...

CVE-2024-24558 react-query-streamed-hydration xss

TanStack Query supplies asynchronous state management, server-state utilities and data fetching for the web. The @tanstack/react-query-next-experimental NPM package is vulnerable to a cross-site scripting vulnerability. To exploit this, an attacker would need to either inject malicious input or...

CVE-2024-24558 react-query-streamed-hydration xss

TanStack Query supplies asynchronous state management, server-state utilities and data fetching for the web. The @tanstack/react-query-next-experimental NPM package is vulnerable to a cross-site scripting vulnerability. To exploit this, an attacker would need to either inject malicious input or...

CVE-2024-24558 react-query-streamed-hydration xss

TanStack Query supplies asynchronous state management, server-state utilities and data fetching for the web. The @tanstack/react-query-next-experimental NPM package is vulnerable to a cross-site scripting vulnerability. To exploit this, an attacker would need to either inject malicious input or...

CVE-2024-24558

The CVE-2024-24558 entry concerns the TanStack Query package, specifically the @tanstack/react-query-next-experimental component. The vulnerability is a cross‑site scripting (XSS) flaw that arises from improper handling of untrusted input during server‑side rendering, allowing an attacker to inje...

TanStack Query Cross-Site Scripting Vulnerability

TanStack Query is an open source, full-featured, TypeScript-enabled library from TanStack Open Source. A cross-site scripting vulnerability exists in TanStack Query. An attacker can exploit this vulnerability to inject malicious input...

PT-2024-20448 · Npm · @Tanstack/React-Query-Next-Experimental

Name of the Vulnerable Software and Affected Versions: @tanstack/react-query-next-experimental versions prior to 5.18.0 Description: The @tanstack/react-query-next-experimental NPM package is vulnerable to a cross-site scripting vulnerability. To exploit this, an attacker would need to either...