react-query-streamed-hydration Cross-site Scripting vulnerability

Description

The @tanstack/react-query-next-experimental NPM package is vulnerable to a cross-site scripting vulnerability. To exploit this, an attacker would need to either inject malicious input or arrange to have malicious input be returned from an endpoint.

Recommendation

Update the @tanstack/react-query-next-experimental package to the latest compatible version. Followings are version details:

• Affected version(s): >= 5.0.0, < 5.18.0
• Patched version(s): 5.18.0

References

• GHSA-997g-27x8-43rf
• CVE-2024-24558
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Cross-site scripting vulnerability in TinyMCE - tinymce - CVE-2024-21911
• Cross-site scripting vulnerability in TinyMCE plugins - CVE-2024-21910
• TinyMCE Cross-Site Scripting (XSS) vulnerability using noneditable_regexp option - CVE-2024-38356
• TinyMCE Cross-Site Scripting (XSS) vulnerability using noscript elements - CVE-2024-38357

You might also like:

Exploiting Server Version Disclosure

How do hackers hack websites?

CSRF, XXE, and 12 Other Security Acronyms Explained

Tags:

npm

@tanstack/react-query-next-experimental