CVE-2026-78177

MEDIUM 4.5

TanStack devtools-vite Development Devtools Event Bus package-manager.ts installPackage os command injection

CVSS Score

4.5

EPSS Score

0.0%

EPSS Percentile

0th

A vulnerability was found in TanStack devtools-vite 0.7.0. Affected by this issue is the function installPackage of the file packages/devtools-bundler-core/src/package-manager.ts of the component Development Devtools Event Bus. The manipulation of the argument packageName results in os command injection. Attacking locally is a requirement. A high complexity level is associated with this attack. The exploitation is known to be difficult. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

CWE	CWE-78 CWE-77
Vendor	tanstack
Product	devtools-vite
Published	Aug 24, 2026

Stay Ahead of the Next One

Get instant alerts for tanstack devtools-vite

Be the first to know when new medium vulnerabilities affecting tanstack devtools-vite are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

TanStack / devtools-vite

0.7.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/394561 vuldb.com: https://vuldb.com/vuln/394561/cti vuldb.com: https://vuldb.com/cve/CVE-2026-78177 vuldb.com: https://vuldb.com/submit/884155 github.com: https://github.com/TanStack/devtools/issues/464

Credits

🔍 wjm3 (VulDB User) VulDB CNA Team