Summary
A critical cross-site scripting vulnerability in TanStack Start server functions can allow an unauthenticated attacker to make a crafted server-function URL return attacker-controlled HTML from the application's origin. If a visitor opens that URL, injected script may access same-origin data and send requests using the visitor's authority.
A critical cross-site scripting vulnerability in TanStack Start server functions can allow an unauthenticated attacker to make a crafted server-function URL return attacker-controlled HTML from the application's origin. If a visitor opens that URL, injected script may access same-origin data and send requests using the visitor's authority.
Affected context
The issue may occur in TanStack Start applications using affected server-function components when specially crafted request payload fields influence middleware state and the error-handling path. It becomes especially risky when the resulting response is interpreted as HTML by a browser and users can be persuaded to open attacker-controlled URLs.
The issue may occur in TanStack Start applications using affected server-function components when specially crafted request payload fields influence middleware state and the error-handling path. It becomes especially risky when the resulting response is interpreted as HTML by a browser and users can be persuaded to open attacker-controlled URLs.
Exploit preconditions
- Attack surface: Public server-function endpoints and their generated URLs
- Required access: No authentication is required to submit the crafted request
- Trigger point: A server-function request reaches middleware and error handling with attacker-controlled non-public fields
- Victim interaction: A visitor must open the resulting URL in a browser
- Why exploitation is possible: A response-shaped object can be accepted as an HTTP response, allowing attacker-controlled HTML to be served from the application's origin
- Attack surface: Public server-function endpoints and their generated URLs
- Required access: No authentication is required to submit the crafted request
- Trigger point: A server-function request reaches middleware and error handling with attacker-controlled non-public fields
- Victim interaction: A visitor must open the resulting URL in a browser
- Why exploitation is possible: A response-shaped object can be accepted as an HTTP response, allowing attacker-controlled HTML to be served from the application's origin
Why this happens
The vulnerability results from insufficient separation between internal server-function state and externally supplied request data. Attacker-controlled fields can influence middleware and error-path processing, where an object with response-like properties is treated as a valid HTTP response without adequate output or type validation.
This behavior maps to CWE-79: Improper Neutralization of Input During Web Page Generation, because untrusted data can reach an HTML response context and become executable browser content.
The vulnerability results from insufficient separation between internal server-function state and externally supplied request data. Attacker-controlled fields can influence middleware and error-path processing, where an object with response-like properties is treated as a valid HTTP response without adequate output or type validation.
This behavior maps to CWE-79: Improper Neutralization of Input During Web Page Generation, because untrusted data can reach an HTML response context and become executable browser content.
Potential impact
- An attacker may execute JavaScript in a visitor's origin context
- Injected script could read accessible same-origin data
- An attacker could issue requests using the visitor's authenticated authority
- User sessions, application data, or administrative actions could be exposed
- The vulnerability could enable phishing, data modification, or account compromise
- An attacker may execute JavaScript in a visitor's origin context
- Injected script could read accessible same-origin data
- An attacker could issue requests using the visitor's authenticated authority
- User sessions, application data, or administrative actions could be exposed
- The vulnerability could enable phishing, data modification, or account compromise
General mitigation guidance
Mitigation generally focuses on preventing untrusted request data from controlling response construction or HTML content.
Common defensive patterns include:
- Treating server-function request fields as untrusted and excluding internal state from client-controlled input
- Enforcing strict schemas and allowlists for request payloads and middleware state
- Separating error objects from HTTP response objects using explicit types and controlled response factories
- Returning non-HTML, safely encoded error responses by default
- Applying contextual output encoding and restrictive content security policies
- Limiting server-function privileges and requiring authorization for sensitive operations
- Testing malformed requests and error paths as part of security-focused application testing
Mitigation generally focuses on preventing untrusted request data from controlling response construction or HTML content.
Common defensive patterns include:
- Treating server-function request fields as untrusted and excluding internal state from client-controlled input
- Enforcing strict schemas and allowlists for request payloads and middleware state
- Separating error objects from HTTP response objects using explicit types and controlled response factories
- Returning non-HTML, safely encoded error responses by default
- Applying contextual output encoding and restrictive content security policies
- Limiting server-function privileges and requiring authorization for sensitive operations
- Testing malformed requests and error paths as part of security-focused application testing
How teams detect issues like this
Organizations can look for this class of issue through:
- Static analysis rules identifying implicit conversion of user-controlled objects into HTTP responses
- Code review checks for client-controlled fields reaching middleware state or error handlers
- Tests that submit unexpected fields and verify that responses cannot change content type or body unexpectedly
- Dynamic testing of public server-function URLs for reflected HTML and script execution
- Content Security Policy reporting and web application monitoring for unusual inline script or response behavior
- CI policy checks requiring schema validation and explicit response construction on server boundaries
Organizations can look for this class of issue through:
- Static analysis rules identifying implicit conversion of user-controlled objects into HTTP responses
- Code review checks for client-controlled fields reaching middleware state or error handlers
- Tests that submit unexpected fields and verify that responses cannot change content type or body unexpectedly
- Dynamic testing of public server-function URLs for reflected HTML and script execution
- Content Security Policy reporting and web application monitoring for unusual inline script or response behavior
- CI policy checks requiring schema validation and explicit response construction on server boundaries
