CVE-2026-78177

Name of the Vulnerable Software and Affected Versions TanStack devtools-vite version 0.7.0

Description An OS command injection issue exists within the Development Devtools Event Bus component. The problem occurs in the installPackage() function located in the packages/devtools-bundler-core/src/package-manager.ts file. Manipulation of the packageName argument allows for the execution of arbitrary operating system commands. This attack requires local access and is characterized by high complexity and difficult exploitation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict the use of the installPackage() function to minimize the risk of exploitation.