CyberRota Analysis
AI-GeneratedThe vulnerability exists in the installPackage function of TanStack devtools-vite version 0.7.0, allowing for OS command injection through improper handling of the packageName argument. While the attack requires local access and has a high complexity level, the public disclosure of the exploit raises concerns for developers using this tool. Organizations utilizing TanStack devtools-vite should prioritize addressing this vulnerability to mitigate potential risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A vulnerability was found in TanStack devtools-vite 0.7.0. Affected by this issue is the function installPackage of the file packages/devtools-bundler-core/src/package-manager.ts of the component Development Devtools Event Bus. The manipulation of the argument packageName results in os command injection. Attacking locally is a requirement. A high complexity level is associated with this attack. The exploitation is known to be difficult. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.