CVE-2026-78177
Received Received - Intake

Command Injection in TanStack Devtools-Vite

Publication date: 2026-08-24

Last updated on: 2026-08-24

Assigner: VulDB

Description
A vulnerability was found in TanStack devtools-vite 0.7.0. Affected by this issue is the function installPackage of the file packages/devtools-bundler-core/src/package-manager.ts of the component Development Devtools Event Bus. The manipulation of the argument packageName results in os command injection. Attacking locally is a requirement. A high complexity level is associated with this attack. The exploitation is known to be difficult. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-24
Last Modified
2026-08-24
Generated
2026-08-24
AI Q&A
2026-08-24
EPSS Evaluated
N/A
NVD
CVE-2026-78177
EUVD
EUVD-2026-64694

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
tanstack devtools_vite 0.7.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-77 The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-78177 is a command injection vulnerability in TanStack devtools-vite 0.7.0. It allows attackers to execute arbitrary shell commands on the host system by manipulating the packageName argument in the installPackage function. The vulnerability occurs because untrusted input from event payloads is directly used in shell commands without validation.

Detection Guidance

Check if the TanStack Devtools Vite plugin version 0.7.0 is installed. Monitor network traffic on port 4206 for suspicious WebSocket or HTTP events. Look for unexpected shell commands or file creation in system logs.

Impact Analysis

An attacker could exploit this to run malicious commands on your system, such as creating files, accessing sensitive data, or escalating privileges. The risk increases if the devtools event bus is exposed beyond localhost. Exploitation requires local access but has high complexity.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR and HIPAA compliance. Unauthorized command execution may expose sensitive data, triggering legal and regulatory penalties for non-compliance.

Mitigation Strategies

Upgrade to a patched version of TanStack Devtools Vite. Avoid exposing the devtools event bus (port 4206) to untrusted networks. Use safer process execution methods like spawn or execFile with shell disabled. Validate and sanitize package names before processing.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-78177. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart