GHSA-QX66-FV34-FJM8 TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses

Impact An unauthenticated attacker can craft a URL to a server function in an affected TanStack Start app. If someone opens the link, the app can return attacker-controlled HTML from its own origin and run the attacker's JavaScript there. The script can access same-origin data available to that...