TanStack React Query Next Experimental Package Vulnerable to Cross-Site Scripting Attacks
CVE-2024-24558

6.1MEDIUM

Key Information:

Vendor

TanStack

Status
query
Vendor
CVE Published:
30 January 2024

What is CVE-2024-24558?

TanStack Query supplies asynchronous state management, server-state utilities and data fetching for the web. The @tanstack/react-query-next-experimental NPM package is vulnerable to a cross-site scripting vulnerability. To exploit this, an attacker would need to either inject malicious input or arrange to have malicious input be returned from an endpoint. To fix this issue, please update to version 5.18.0 or later.

Affected Version(s)

query >=5.0.0, < 5.18.0

References

https://github.com/TanStack/query/security/advisories/GHS...
x_refsource_CONFIRM
https://github.com/TanStack/query/commit/f2ddaf2536e8b71d...
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.