CVE-2026-45321 @Tanstack Arktype-Adapter
On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for…
- CVSS
- 9.6 Critical
- EPSS
- 3.3%
- Percentile
- 89
- Published
- 2026-05-12
- Force
- 11 of 12
- Public PoC
- 12
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
On CISA’s exploited list
TanStack Unspecified Vulnerability
- Added
- 2026-05-27
- Federal patch deadline
- 2026-06-10
- Ransomware use
- known