react-query-streamed-hydration Cross-site Scripting vulnerability

Description

The @tanstack/react-query-next-experimental NPM package is vulnerable to a cross-site scripting vulnerability. To exploit this, an attacker would need to either inject malicious input or arrange to have malicious input be returned from an endpoint.

Recommendation

Update the @tanstack/react-query-next-experimental package to the latest compatible version. Followings are version details:

• Affected version(s): >= 5.0.0, < 5.18.0
• Patched version(s): 5.18.0

References

• GHSA-997g-27x8-43rf
• CVE-2024-24558
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6