CVE-2026-45321

Katalog CVE

CVSS 9.6 · Critical KEV · sudah dieksploitasi Dipakai ransomware EPSS 1,1%

Kerentanan Embedded Malicious Code pada tanstack/arktype-adapter, tanstack/eslint-plugin-router +28 lainnya. Skor CVSS 3.1 9.6 (Critical) menurut github.com. Masuk katalog KEV CISA pada 27 Mei 2026, artinya sudah terbukti dieksploitasi. Tercatat dipakai dalam kampanye ransomware.

Deskripsi (NVD)

On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for TanStack/router, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a pull_request_target "Pwn Request" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity. Each affected package received exactly two malicious versions, published a few minutes apart.

Rincian

Terbit di NVD

12 Mei 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.6 (Critical), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-506: Embedded Malicious Code

EPSS (30 hari)

1,1% peluang dieksploitasi; lebih tinggi dari 63,4% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

TanStack Unspecified Vulnerability

Masuk KEV

27 Mei 2026

Tenggat CISA

10 Juni 2026 (untuk instansi federal AS)

Ransomware

Tercatat dipakai dalam kampanye ransomware

Tindakan wajib

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD. Ditampilkan 60 dari 343 konfigurasi; daftar lengkap ada di NVD.

Referensi dan perbaikan

• https://github.com/TanStack/router/security/advisories/GHSA-g7cv-rxg3-hmpx mitigasi · advisory vendor
• https://tanstack.com/blog/npm-supply-chain-compromise-postmortem exploit · advisory vendor
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-45321 pemerintah AS
• https://www.stepsecurity.io/blog/mini-shai-hulud-is-back-a-self-spreading-supply-chain-attack-hits-the-npm-eco... exploit · advisory pihak ketiga
• https://github.com/TanStack/router/issues/7383 issue tracking