TanStack patched critical XSS flaw CVE-2026-102989 in TanStack Start after a report from Lovable

Archive entry: this covers an event from September 30, 2026, and we published it on November 8, 2026. The details come from sources dated at the time and may have changed since.

On September 30, 2026, TanStack shipped fixes for CVE-2026-102989, a critical reflected cross-site scripting (XSS) flaw in TanStack Start server-function responses, as described in its TanStack Start security update post. TanStack privately briefed hosting providers, distributors and affected partners before the release and thanked Lovable for helping discover and fix the issue.

What the vulnerability was

• The GitHub security advisory GHSA-qx66-fv34-fjm8 described an unauthenticated reflected XSS rated critical, with a CVSS 3.1 score of 9.3 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N).
• An attacker could craft a URL to a server function. If someone opened it, the app could return attacker-controlled HTML from its own origin and run the attacker's JavaScript with that visitor's access.
• Affected versions started at 1.143.12. The patched releases were @tanstack/react-start 1.168.60, @tanstack/solid-start 1.168.57, @tanstack/vue-start 1.168.56 and @tanstack/start-server-core 1.169.39.
• TanStack said the fix restricted client-supplied input and validated responses at the server boundary.

What it meant for people who build with AI

TanStack Start ran many AI-built apps, including Lovable projects. Updating a local install alone did not patch an app that was already deployed, so teams that hosted such apps elsewhere had to upgrade and redeploy themselves.

How Lovable and Netlify responded

• Lovable said a researcher on its security team found the flaw on September 14, 2026, reported it to TanStack the same day and enforced firewall rules for apps hosted on Lovable. Its post on protecting apps from the TanStack Start vulnerability said it found no evidence of exploitation in the logs it reviewed.
• Lovable's coding agent upgraded TanStack Start to the patched version the next time an affected project was changed, users could apply the fix from the project's Security page at no credit cost, and projects created in Lovable started on the patched version.
• Netlify recommended upgrading as soon as possible and warned that publicly available deploy previews and branch deploys might stay vulnerable until they were deleted, in its security update on TanStack Start.

Sources

• TanStack Start security update: CVE-2026-102989 (TanStack, September 30, 2026, official)
• Unauthenticated reflected XSS in TanStack Start server-function responses (TanStack (GitHub Security Advisory), September 30, 2026, official)
• A vulnerability in TanStack Start: what we found and what we did to protect your apps (Lovable, September 30, 2026, official)
• Security Update: Cross-site scripting in TanStack Start (Netlify, September 30, 2026, official)

Written with AI assistance, strictly from the sources listed above. Before it went live, automated checks verified its dates, sources and every language edition.