Live › vulnerability › CVE-2026-102989
Go to dashboardTanStack Router has a reflected cross-site scripting flaw that lets an unauthenticated attacker inject scripts into pages other users view. The sources say this can lead to session hijacking or unauthorized actions in the victim's browser.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-24 17:18 UTC, 0h before NVD. All times on this page are UTC.
The sources do not name the affected versions or the configurations that expose the flaw. Teams running TanStack Router web applications that reflect request input into pages should treat them as potentially affected, and the rest can deprioritize this entry.
No product ranges from the sources yet.
TanStack - Reflected XSS - CVE:CVE-2026-102989 is present and set to Block.TanStack - Reflected XSS - CVE:CVE-2026-102989 to Block, as the Cloudflare changelog describes.What vendors did on their customers’ behalf. Holds only for traffic through them; patching is still the fix.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
WAF Release - 2026-10-12 · Changelog
New updates and improvements at Cloudflare.
October 12, 2026
This release introduces new detections to mitigate recent vulnerabilities affecting TanStack and Atlassian products.
Key Findings
| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |
|---|---|---|---|---|---|---|
| Cloudflare Managed Ruleset | ...02751ef3 | N/A | Generic Rules - Template Injection - 2 - Beta | Disabled | Disabled | This rule is merged into the original rule "Generic Rules - Template Injection - 2" (ID: ...d3ed0123). |
| Cloudflare Managed Ruleset | ...4ee560b2 | N/A | TanStack - Reflected XSS - CVE:CVE-2026-102989 | N/A | Block | This is a new detection. |
| Cloudflare Managed Ruleset | ...e919cd31 | N/A | Atlassian - Arbitrary File Access - CVE:CVE-2026-21589 | N/A | Block | This is a new detection. |
This page as .md · .json · in your agent: get_signal("CVE-2026-102989")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.