RCE in Tanstack Devtools-Vite
CVE-2026-78177
A vulnerability was found in TanStack devtools-vite 0.7.0. Affected by this issue is the function installPackage of the file packages/devtools-bundler-core/src/package-manager.ts of the component Development Devtools Event Bus. The manipulation of the argument packageName results in os command injection. Attacking locally is a requirement. A high complexity level is associated with this attack. The exploitation is known to be difficult. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
Vulnerability class: Command Injection (OS Command Injection)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 4.5 (Medium). Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L.
EPSS exploit prediction
EPSS: 0.009 (58.6th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 59th percentile — 58.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.006 · newest: 0.009 · change: +0.003
Affected products
- Tanstack Devtools-Vite — versions 0.7.0
Weakness classification (CWE)
References
- vuldb.com/vuln/394561 (technical-description, vdb-entry)
- vuldb.com/vuln/394561/cti (signature, permissions-required)
- vuldb.com/cve/CVE-2026-78177 (third-party-advisory)
- vuldb.com/submit/884155 (third-party-advisory)
- github.com/TanStack/devtools/issues/464 (issue-tracking, exploit)
Frequently asked questions
- What is CVE-2026-78177?
- CVE-2026-78177 is a medium-severity vulnerability in Tanstack Devtools-Vite, classified under Command Injection. CVSS score: 4.5/10. Published 2026-08-24.
- How severe is CVE-2026-78177?
- Medium severity. CVSS v3 base score is 4.5 out of 10.