{"id":"CVE-2026-102989","kind":"vulnerability","aliases":["CVE-2026-102989"],"related":[],"title":"TanStack Router: unauthenticated reflected XSS can hijack user sessions","description":"WAF Release - 2026-10-12 · Changelog\n\n# Changelog\n\nNew updates and improvements at Cloudflare.\n\nOctober 12, 2026\n\n## WAF Release - 2026-10-12\n\nThis release introduces new detections to mitigate recent vulnerabilities affecting TanStack and Atlassian products.\n\nKey Findings\n\n- CVE-2026-102989: A reflected Cross-Site Scripting (XSS) vulnerability affecting TanStack. Unauthenticated attackers can exploit this flaw to inject malicious scripts into web pages viewed by other users, potentially leading to session hijacking or unauthorized actions.\n- CVE-2026-21589: An arbitrary file access vulnerability affecting Atlassian products. Threat actors can exploit this flaw to read unauthorized files on the target system, risking the exposure of sensitive configuration data.\n\n| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |\n| --- | --- | --- | --- | --- | --- | --- |\n| Cloudflare Managed Ruleset | ...02751ef3 | N/A | Generic Rules - Template Injection - 2 - Beta | Disabled | Disabled | This rule is merged into the original rule \"Generic Rules - Template Injection - 2\" (ID: ...d3ed0123). |\n| Cloudflare Managed Ruleset | ...4ee560b2 | N/A | TanStack - Reflected XSS - CVE:CVE-2026-102989 | N/A | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...e919cd31 | N/A | Atlassian - Arbitrary File Access - CVE:CVE-2026-21589 | N/A | Block | This is a new detection. |","summary":"TanStack Router has a reflected cross-site scripting flaw that lets an unauthenticated attacker inject scripts into pages other users view. The sources say this can lead to session hijacking or unauthorized actions in the victim's browser.","severity":"critical","cvss":9.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cloudflare","lab-disclosure","package","tanstack-router","web-apps"],"not_affected_if":[],"how_to_check":"- unknown: the sources do not name the affected TanStack Router versions or the code path that reflects input.\n- Cloudflare WAF customers: check whether the managed rule `TanStack - Reflected XSS - CVE:CVE-2026-102989` is present and set to Block.","fix":"- Upgrade TanStack Router to a patched release; the version is unknown from these sources.\n- Cloudflare WAF customers: set the managed rule `TanStack - Reflected XSS - CVE:CVE-2026-102989` to Block, as the Cloudflare changelog describes.","status":"open","published_at":"2026-10-12T17:17:57+00:00","first_seen_at":"2026-10-24T17:18:15+00:00","triaged_at":"2026-10-25T02:59:52+00:00","updated_at":"2026-10-25T02:59:52+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T02:59:52Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade TanStack Router to a patched release; the version is unknown from these sources.\n- Cloudflare WAF customers: set the managed rule `TanStack - Reflected XSS - CVE:CVE-2026-102989` to Block, as the Cloudflare changelog describes.","reach":"internet","title":"TanStack Router: unauthenticated reflected XSS can hijack user sessions","impact":"high","summary":"TanStack Router has a reflected cross-site scripting flaw that lets an unauthenticated attacker inject scripts into pages other users view. The sources say this can lead to session hijacking or unauthorized actions in the victim's browser.","category":"package","nicknames":[],"who_cares":["tanstack-router","web-apps"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker runs scripts in victims' browsers, hijacking sessions and actions","analyst_note":"Find the TanStack advisory for the affected and patched Router versions; the NVD link in the sources does not give them.","how_to_check":"- unknown: the sources do not name the affected TanStack Router versions or the code path that reflects input.\n- Cloudflare WAF customers: check whether the managed rule `TanStack - Reflected XSS - CVE:CVE-2026-102989` is present and set to Block.","needs_analyst":true,"not_affected_if":[],"who_is_affected":"The sources do not name the affected versions or the configurations that expose the flaw. Teams running TanStack Router web applications that reflect request input into pages should treat them as potentially affected, and the rest can deprioritize this entry.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.001329,"input_tokens":3895,"output_tokens":1880,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-10':69C,85C '-102989':12A,15A,105C,224C '-12':70C,86C '-2026':11A,14A,104C,142C,223C,243C '-21589':143C,244C '02751ef3':188C '12':80C '2':194C,210C '2026':68C,81C,84C '4ee560b2':216C 'access':147C,240C 'action':60B,140C,181C,183C 'actor':153C 'affect':96C,114C,149C 'app':26B 'arbitrari':145C,238C 'atlassian':99C,150C,237C 'attack':41B,117C 'beta':195C 'block':226C,246C 'browser':65B 'changelog':71C,72C 'cloudflar':16B,78C,185C,213C,232C 'comment':184C 'configur':171C 'cross':33B,109C 'cross-sit':32B,108C 'cve':10A,13A,103C,141C,221C,222C,241C,242C 'd3ed0123':212C 'data':172C 'descript':179C 'detect':91C,231C,251C 'disabl':196C,197C 'disclosur':19B 'e919cd31':235C 'exploit':119C,155C 'exposur':168C 'file':146C,161C,239C 'find':102C 'flaw':36B,121C,157C 'generic':190C,206C 'hijack':7A,57B,137C 'id':175C,178C,211C 'improv':76C 'inject':42B,123C,193C,209C 'introduc':89C 'key':101C 'lab':18B 'lab-disclosur':17B 'lead':54B,134C 'legaci':176C 'let':38B 'malici':124C 'manag':186C,214C,233C 'merg':201C 'mitig':93C 'n/a':189C,217C,225C,236C,245C 'new':73C,90C,182C,230C,250C 'octob':79C 'origin':204C 'packag':20B 'page':45B,128C 'potenti':133C 'previous':180C 'product':100C,151C 'read':159C 'recent':94C 'reflect':4A,31B,107C,219C 'releas':67C,83C,88C 'risk':166C 'router':2A,23B,28B 'rule':174C,177C,191C,199C,205C,207C 'ruleset':173C,187C,215C,234C 'say':51B 'script':35B,43B,111C,125C 'sensit':170C 'session':9A,56B,136C 'site':34B,110C 'sourc':50B 'system':165C 'tanstack':1A,22B,27B,97C,115C,218C 'tanstack-rout':21B 'target':164C 'templat':192C,208C 'threat':152C 'unauthent':3A,40B,116C 'unauthor':59B,139C,160C 'updat':74C 'user':8A,47B,132C 'victim':63B 'view':48B,129C 'vulner':95C,113C,148C 'waf':66C,82C 'web':25B,127C 'web-app':24B 'xss':5A,112C,220C","nicknames":[],"mitigations":[{"kind":"waf-rule","since":"2026-10-12","covers":"Requests matching the TanStack reflected XSS pattern, via Cloudflare Managed Ruleset rule TanStack - Reflected XSS - CVE:CVE-2026-102989","limits":"Only traffic proxied through Cloudflare; the rule covers only the detected pattern","source":"https://developers.cloudflare.com/changelog/post/2026-10-12-waf-release/","vendor":"Cloudflare","seen_at":"2026-10-24T17:31:23Z","confidence":0.9,"source_title":"Cloudflare: WAF Release - 2026-10-12 · Changelog","customer_action":"none stated"}],"who_affected":"The sources do not name the affected versions or the configurations that expose the flaw. Teams running TanStack Router web applications that reflect request input into pages should treat them as potentially affected, and the rest can deprioritize this entry.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-12T17:17:57+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"lab","external_id":"https://developers.cloudflare.com/changelog/post/2026-10-12-waf-release/#CVE-2026-102989","url":"https://developers.cloudflare.com/changelog/post/2026-10-12-waf-release/","severity":null,"published_at":"2026-10-12T17:17:57+00:00","modified_at":null,"first_seen_at":"2026-10-24T17:18:15+00:00","fetched_at":"2026-10-24T17:18:15+00:00","note":"Cloudflare: WAF Release - 2026-10-12 · Changelog"},{"source":"nvd","external_id":"CVE-2026-102989","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102989","severity":null,"published_at":"2026-10-13T17:17:14+00:00","modified_at":"2026-10-16T16:00:33+00:00","first_seen_at":"2026-10-24T17:18:50+00:00","fetched_at":"2026-10-24T17:18:50+00:00","note":null}],"documents":[{"id":2841,"url":"https://developers.cloudflare.com/changelog/post/2026-10-12-waf-release/","title":"Cloudflare: WAF Release - 2026-10-12 · Changelog","kind":"advisory","source":"lab","text":"WAF Release - 2026-10-12 · Changelog\n\n# Changelog\n\nNew updates and improvements at Cloudflare.\n\nOctober 12, 2026\n\n## WAF Release - 2026-10-12\n\nThis release introduces new detections to mitigate recent vulnerabilities affecting TanStack and Atlassian products.\n\nKey Findings\n\n- CVE-2026-102989: A reflected Cross-Site Scripting (XSS) vulnerability affecting TanStack. Unauthenticated attackers can exploit this flaw to inject malicious scripts into web pages viewed by other users, potentially leading to session hijacking or unauthorized actions.\n- CVE-2026-21589: An arbitrary file access vulnerability affecting Atlassian products. Threat actors can exploit this flaw to read unauthorized files on the target system, risking the exposure of sensitive configuration data.\n\n| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |\n| --- | --- | --- | --- | --- | --- | --- |\n| Cloudflare Managed Ruleset | ...02751ef3 | N/A | Generic Rules - Template Injection - 2 - Beta | Disabled | Disabled | This rule is merged into the original rule \"Generic Rules - Template Injection - 2\" (ID: ...d3ed0123). |\n| Cloudflare Managed Ruleset | ...4ee560b2 | N/A | TanStack - Reflected XSS - CVE:CVE-2026-102989 | N/A | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...e919cd31 | N/A | Atlassian - Arbitrary File Access - CVE:CVE-2026-21589 | N/A | Block | This is a new detection. |","published_at":"2026-10-12T17:17:57+00:00","relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}