CVE-2026-45321
CVSS v3
9.6
CRITICAL
EPSS Score
0.0 %
exploit probability
CISA KEV
Yes
known exploited
Exploitation
—
SSVC status
Description
On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for TanStack/router, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a pull_request_target "Pwn Request" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and r
CISA Known Exploited Vulnerability
- Date Added
- 2026-05-27
- Patch Due Date
- 2026-06-10
- Ransomware Use
- Unknown
Technical details
- Published
- 2026-05-12
Frequently asked questions
What is CVE-2026-45321?
On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for TanStack/router, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a pull_request_target "Pwn Request" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and r
Is CVE-2026-45321 actively exploited?
Yes. CVE-2026-45321 is on the CISA Known Exploited Vulnerabilities (KEV) catalog, meaning it has been confirmed as actively exploited in the wild. CISA requires federal agencies to patch by 2026-06-10.
What is the CVSS score for CVE-2026-45321?
CVE-2026-45321 has a CVSS v3 base score of 9.6 (CRITICAL severity).
Is CVE-2026-45321 affecting your environment?
Use isMalicious to check if any of your IPs or domains are associated with this vulnerability's IOCs.
No credit card required · 500 free checks/month · Free API key
Other 2026 vulnerabilities worth triaging
Ranked by exploit probability (EPSS).
- CVE-2026-24061KEV
- CVE-2026-27174MajorDoMo Unauthenticated Remote Code Execution via Admin Console Eval
- CVE-2026-60004KEV
- CVE-2026-1281KEV
- CVE-2026-24423KEVSmarterTools SmarterMail < Build 9511 Unauthenticated RCE via ConnectToHub API
- CVE-2026-1731KEVRemote code execution vulnerability in BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA)
- CVE-2026-23760KEVSmarterTools SmarterMail < Build 9511 Authentication Bypass via Password Reset API
- CVE-2026-22200osTicket (1.18.x < 1.18.3, 1.17.x < 1.17.7) PDF Export Arbitrary File Read