CVE-2026-45321

9.6 CRITICAL

On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm ...

Published: 2026-05-12 · Last updated: 2026-05-29

Severity and scoring

CVSS: 9.6 CRITICAL
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
CWE: CWE-506

Affected products

Vendor	Product
abhishake1	agentwork-cli, beproduct\/nestjs-auth, cmux-agent-mcp
agentworkhq	agentwork-cli, beproduct\/nestjs-auth, cmux-agent-mcp
antoinebcx	agentwork-cli, beproduct\/nestjs-auth, cmux-agent-mcp
beproduct	agentwork-cli, beproduct\/nestjs-auth, cmux-agent-mcp
christianalares	agentwork-cli, beproduct\/nestjs-auth, cmux-agent-mcp
dirigible	agentwork-cli, beproduct\/nestjs-auth, cmux-agent-mcp
guardrailsai	agentwork-cli, beproduct\/nestjs-auth, cmux-agent-mcp
kilbot	agentwork-cli, beproduct\/nestjs-auth, cmux-agent-mcp
linuxfoundation	agentwork-cli, beproduct\/nestjs-auth, cmux-agent-mcp
matheuspergoli	agentwork-cli, beproduct\/nestjs-auth, cmux-agent-mcp
mesa	agentwork-cli, beproduct\/nestjs-auth, cmux-agent-mcp
mistral	agentwork-cli, beproduct\/nestjs-auth, cmux-agent-mcp
multiagentcognition	agentwork-cli, beproduct\/nestjs-auth, cmux-agent-mcp
neilcochran	agentwork-cli, beproduct\/nestjs-auth, cmux-agent-mcp
tanstack	agentwork-cli, beproduct\/nestjs-auth, cmux-agent-mcp
uipath	agentwork-cli, beproduct\/nestjs-auth, cmux-agent-mcp

Description

On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for TanStack/router, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a pull_request_target "Pwn Request" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity. Each affected package received exactly two malicious versions, published a few minutes apart.

Source: NVD

References

[NVD]https://nvd.nist.gov/vuln/detail/CVE-2026-45321
[Other]https://github.com/TanStack/router/issues/7383
[Vendor advisory]https://github.com/TanStack/router/security/advisories/GHSA-g7cv-rxg3-hmpx
[Vendor advisory]https://tanstack.com/blog/npm-supply-chain-compromise-postmortem
[Exploit reference]https://www.stepsecurity.io/blog/mini-shai-hulud-is-back-a-self-spreading-supply-chain-attack-hits-the-npm-ecosystem
[Other]https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-45321

Related CVEs

Same vendor

CVE-2026-45758 — Guardrails AI is a Python framework that helps build AI applications (9.6 CRITICAL)
CVE-2026-44477 — CloudNativePG is a platform designed to manage PostgreSQL databases within Kubernetes environments (9.9 CRITICAL)
CVE-2026-44247 — Volcano is a Kubernetes-native batch scheduling system (6.8 MEDIUM)
CVE-2026-44374 — Backstage is an open framework for building developer portals (4.3 MEDIUM)
CVE-2026-37531 — AGL app-framework-main thru 17.1.12 contains a Zip Slip path traversal vulnerability (CWE-22) combined with a TOCTOU race condition (CWE-... (9.8 CRITICAL)

Same CWE

CVE-2026-45758 — Guardrails AI is a Python framework that helps build AI applications (9.6 CRITICAL)
CVE-2026-48027 — Nx Console is the user interface for Nx & Lerna (9.8 CRITICAL)
CVE-2026-8398 — A supply chain attack compromised the official installation packages of DAEMON Tools Lite (Windows versions 12.5.0.2421 through 12.5.0.24... (9.8 CRITICAL)
CVE-2026-44484 — PyTorch Lightning is a deep learning framework to pretrain and finetune AI models (9.8 CRITICAL)