Vulnerability	Vulnerable Version
C Cross-site Scripting (XSS) Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via improper handling of server function transport responses, where the spread of the full `opts` object into the server function context in `createServerFn.ts` allows attacker-controlled properties (such as `method`) to override internal context values. Combined with insufficient response validation in the server-side request/response pipeline, an attacker can cause malicious content to be reflected into a cross-origin response, achieving stored or reflected script injection in the victim's browser. How to fix Cross-site Scripting (XSS)? Upgrade `@tanstack/vue-start` to version 1.168.56 or higher.	>=1.143.12 <1.168.56

Cross-site Scripting (XSS)

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via improper handling of server function transport responses, where the spread of the full opts object into the server function context in createServerFn.ts allows attacker-controlled properties (such as method) to override internal context values. Combined with insufficient response validation in the server-side request/response pipeline, an attacker can cause malicious content to be reflected into a cross-origin response, achieving stored or reflected script injection in the victim's browser.

How to fix Cross-site Scripting (XSS)?

Upgrade @tanstack/vue-start to version 1.168.56 or higher.

>=1.143.12 <1.168.56

Go back to all versions of this package