CVE-2026-102989 in TanStack Start: what we found and what we did to protect your apps
Blog post from Lovable
Lovable identified and reported CVE-2026-102989, a TanStack Start vulnerability that could allow specially crafted links to execute unwanted JavaScript in affected apps when opened by visitors, potentially accessing information or performing actions with their permissions. The issue, discovered on September 14, 2026, did not affect every project using TanStack Start, and Lovable reported no evidence of exploitation in reviewed logs. While TanStack prepared an upstream fix, Lovable deployed and refined firewall protections for apps hosted on its platform and coordinated disclosure with the framework’s maintainers. Affected hosted projects will automatically receive the patched version when users next make a change, or they can apply the update free through the project Security page, while new projects already use the corrected version. Lovable will notify affected customers by email, whereas users hosting applications elsewhere must apply TanStack’s update and redeploy through their own hosting environment.
No tracked trend matches for this post yet.
Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.