TanStack Start Framework XSS via Server-Function Request Payload

TanStack Start, the full-stack framework built on TanStack Router, is affected by a cross-site scripting (XSS) vulnerability in its server-function request handling. An unauthenticated attacker can place non-public fields in a server-function request payload so that attacker-controlled middleware state reaches the error path and a response-shaped object is accepted as an HTTP response.

A crafted server-function URL can therefore return attacker-controlled HTML from the application's origin. When a visitor opens the URL, the injected script can access same-origin data and issue requests with the visitor's authority.

Affected versions:

• @tanstack/start-server-core from 1.143.12 until 1.169.39
• @tanstack/react-start until 1.168.60
• @tanstack/solid-start until 1.168.57
• @tanstack/vue-start until 1.168.56

Fixed in @tanstack/start-server-core 1.169.39, @tanstack/react-start 1.168.60, @tanstack/solid-start 1.168.57, and @tanstack/vue-start 1.168.56.