KEV Entry

CVE-2026-45321

Known Exploited Vulnerability Entry External Catalog

Back to Catalog View Vulnerability
Entry Details
Confirmed Exploited

CVE-2026-45321

2026-05-27 18:00 UTC

Timestamps

2026-05-27

2026-05-27

Scope

KEVIntel entry: Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys | Affected: @tanstack / arktype-adapter, eslint-plugin-router, eslint-plugin-start, history, nitro-v2-vite-plugin, react-router, react-router-devtools, react-router-ssr-query, react-start, react-start-client, react-start-rsc, react-start-server, router-cli, router-core, router-devtools, router-devtools-core, router-generator, router-plugin, router-ssr-query-core, router-utils, outer-vite-plugin, solid-router, solid-router-devtools, solid-router-ssr-query, solid-start, solid-start-client, solid-start-server, start-client-core, start-fn-stubs, start-plugin-core, start-server-core, start-static-server-functions, start-storage-context, valibot-adapter, virtual-file-routes, vue-router, vue-router-devtools, vue-router-ssr-query, vue-start, vue-start-client, vue-start-server, zod-adapter | CVSS: 9.6 (CRITICAL) | EPSS: 0.01601 | Used in malware: yes | Not yet in CISA KEV: False

References
  • {'id': 'CVE-2026-45321', 'url': 'https://www.cve.org/CVERecord?id=CVE-2026-45321'}
  • {'id': 'kevintel', 'url': 'https://kevintel.com/vuln/CVE-2026-45321'}

646904ac-0f74-4e7b-bea3-53df73dc0315

caeb2787-0d58-4236-9039-7c86c3e566f3

2026-06-19 12:45 UTC

2026-06-19 12:45 UTC

Evidence
1
Type Source Signal Confidence Details GCVE Metadata
public_report kevintel confirmed_compromise 0.70
View details 
{
  "added_date": "2026-05-27T18:00:02.338Z",
  "ahead_of_cisa_kev": {
    "count": 6,
    "unit": "day"
  },
  "cvss_score": 9.6,
  "cvss_severity": "CRITICAL",
  "epss_percentile": 0.72648,
  "epss_score": 0.01601,
  "feed": "KEVIntel (kevintel.com)",
  "not_yet_in_cisa_kev": false,
  "product": "arktype-adapter, eslint-plugin-router, eslint-plugin-start, history, nitro-v2-vite-plugin, react-router, react-router-devtools, react-router-ssr-query, react-start, react-start-client, react-start-rsc, react-start-server, router-cli, router-core, router-devtools, router-devtools-core, router-generator, router-plugin, router-ssr-query-core, router-utils, outer-vite-plugin, solid-router, solid-router-devtools, solid-router-ssr-query, solid-start, solid-start-client, solid-start-server, start-client-core, start-fn-stubs, start-plugin-core, start-server-core, start-static-server-functions, start-storage-context, valibot-adapter, virtual-file-routes, vue-router, vue-router-devtools, vue-router-ssr-query, vue-start, vue-start-client, vue-start-server, zod-adapter",
  "title": "Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys",
  "used_in_malware": "yes",
  "vendor": "@tanstack"
}
 -
Export Options
JSON Object JSON API View Full Catalog