Soumettre #884155: Node.js @tanstack/devtools-vite 0.7.0 OS Command Injection

A command injection vulnerability exists in the public @tanstack/devtools-vite Vite development server integration.
The package starts a local development event bus for TanStack Devtools. The event bus accepts devtools-related events such as install-devtools / bump-package-version and forwards attacker-controlled package names into package installation logic. The package name is later used to construct a package manager command. Because the value is incorporated into a shell command without sufficient validation or argument separation, shell metacharacters in the package name can lead to arbitrary command execution.
The vulnerable functionality is reachable through the devtools Vite plugin during development. An attacker able to send crafted events to the local devtools event bus can cause the development environment to execute arbitrary operating system commands with the privileges of the developer or CI process running Vite.
Impact:
Remote or local command execution in affected development environments.
Affected version:
@tanstack/devtools-vite 0.7.0
Root cause:
Attacker-controlled event payload data reaches package installation command construction without strict validation and without using safe argv-based process spawning.
Recommended fix:
Use spawn/execFile with shell disabled and pass package manager arguments as an argv array. Validate package names against strict npm package-name rules before invoking package manager operations. Do not pass event-controlled values into shell command strings.

• La source: ⚠️ https://github.com/TanStack/devtools/issues/464
• Utilisateur: wjm3 (UID 99672)
• Soumission: 09/07/2026 14:50 (il y a 2 mois)
• Modérer: 23/08/2026 17:56 (2 months later)
• Statut: Accepté
• Entrée VulDB: 394561 [TanStack devtools-vite 0.7.0 Development Devtools Event Bus package-manager.ts installPackage packageName élévation de privilèges]
• Points: 20