{"generated_at":"2026-10-23T14:08:23.349Z","count":3,"incidents":[{"id":"tanstack-router-unauthenticated-reflected-xss-in-tanstac-cve-2026-102989","url":"https://pwned.coffee/i/tanstack-router-unauthenticated-reflected-xss-in-tanstac-cve-2026-102989","title":"TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses","summary":"## Impact An unauthenticated attacker can craft a URL to a server function in an affected TanStack Start app. If someone opens the link, the app can return attacker-controlled HTML from its own origin and run the attacker's JavaScript there. The script can access same-origin data available to that visitor and make requests with their authority. ## Cause…","severity":"critical","patch_status":"patched","status":"past","exploited":false,"affected":"@tanstack/start-server-core (npm), @tanstack/react-start (npm), @tanstack/solid-start (npm), @tanstack/vue-start (npm)","fixed_versions":["@tanstack/start-server-core 1.169.39","@tanstack/react-start 1.168.60","@tanstack/solid-start 1.168.57","@tanstack/vue-start 1.168.56"],"ids":["CVE-2026-102989"],"stack":["npm","react"],"first_seen":"2026-10-15T20:22:20Z","updated_at":"2026-10-15T20:22:20Z"},{"id":"meta-react-server-components-remote-code-execution-vulne-cve-2025-55182","url":"https://pwned.coffee/i/meta-react-server-components-remote-code-execution-vulne-cve-2025-55182","title":"Meta React Server Components Remote Code Execution Vulnerability","summary":"Meta React Server Components contains a remote code execution vulnerability that could allow unauthenticated remote code execution by exploiting a flaw in how React decodes payloads sent to React Server Function endpoints. Please note CVE-2025-66478 has been rejected, but it is associated with CVE-2025- 55182. Added to CISA KEV on 2025-12-05 (federal deadline 2025-12-12).","severity":"critical","patch_status":"patched","status":"past","exploited":true,"affected":"Meta React Server Components","fixed_versions":[],"ids":["CVE-2025-55182"],"stack":["nextjs","react"],"first_seen":"2025-12-05T12:00:00.000Z","updated_at":"2025-12-05T12:00:00.000Z"},{"id":"react-native-community-cli-os-command-injection-vulnerab-cve-2025-11953","url":"https://pwned.coffee/i/react-native-community-cli-os-command-injection-vulnerab-cve-2025-11953","title":"React Native Community CLI OS Command Injection Vulnerability","summary":"React Native Community CLI contains an OS command injection vulnerability which could allow unauthenticated network attackers to send POST requests to the Metro Development Server and run arbitrary executables via a vulnerable endpoint exposed by the server. On Windows, attackers can also execute arbitrary shell commands with fully controlled arguments. Added to CISA KEV on 2026-02-05 (federal deadline 2026-02-26).","severity":"high","patch_status":"patched","status":"past","exploited":true,"affected":"React Native Community CLI","fixed_versions":[],"ids":["CVE-2025-11953"],"stack":["react","windows"],"first_seen":"2026-02-05T12:00:00.000Z","updated_at":"2026-02-05T12:00:00.000Z"}]}