CVE-2024-24558: react-query-streamed-hydration xss
Impact
The @tanstack/react-query-next-experimental NPM package is vulnerable to a cross-site scripting vulnerability. To exploit this, an attacker would need to either inject malicious input or arrange to have malicious input be returned from an endpoint.
This vulnerability arises from improper handling of untrusted input when @tanstack/react-query-next-experimental performs server-side rendering of HTML pages. To fix this vulnerability, we implemented appropriate escaping to prevent javascript injection into rendered pages.
Patches
To fix this issue, please update to version 5.18.0 or later.
Workarounds
There are no known workarounds for this issue. Please update to version 5.18.0 or later.
Other sources
TanStack Query supplies asynchronous state management, server-state utilities and data fetching for the web. The @tanstack/react-query-next-experimental NPM package is vulnerable to a cross-site scripting vulnerability. To exploit this, an attacker would need to either inject malicious input or arrange to have malicious input be returned from an endpoint. To fix this issue, please update to version 5.18.0 or later.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-24558?
CVE-2024-24558 is classified as a cross-site scripting vulnerability that can lead to significant security risks if exploited.
How do I fix CVE-2024-24558?
To fix CVE-2024-24558, update the @tanstack/react-query-next-experimental package to version 5.18.0 or later.
What software is affected by CVE-2024-24558?
CVE-2024-24558 affects the @tanstack/react-query-next-experimental package in versions between 5.0.0 and 5.18.0.
What types of attacks can CVE-2024-24558 facilitate?
CVE-2024-24558 can facilitate cross-site scripting attacks that exploit malicious input injection.
What are the potential impacts of exploiting CVE-2024-24558?
Exploiting CVE-2024-24558 may allow attackers to run arbitrary scripts in the context of a user's session.