CVE-2024-24558

TanStack Query supplies asynchronous state management, server-state utilities and data fetching for the web. The `@tanstack/react-query-next-experimental` NPM package is vulnerable to a cross-site scripting vulnerability. To exploit this, an attacker would need to either inject malicious input or arrange to have malicious input be returned from an endpoint. To fix this issue, please update to version 5.18.0 or later.

• CWE-79

• https://github.com/TanStack/query/commit/f2ddaf2536e8b71d2da88a9310ac9a48c13512a1Patch
• https://github.com/TanStack/query/security/advisories/GHSA-997g-27x8-43rfVendor Advisory
• https://github.com/TanStack/query/commit/f2ddaf2536e8b71d2da88a9310ac9a48c13512a1Patch
• https://github.com/TanStack/query/security/advisories/GHSA-997g-27x8-43rfVendor Advisory

Published

Jan 30, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-24551A security vulnerability has been identified in Bludit, allo…8.8
• CVE-2024-24552A session fixation vulnerability in Bludit allows an attacke…8.8
• CVE-2024-24553Bludit uses the SHA-1 hashing algorithm to compute password …7.5
• CVE-2024-24554Bludit uses predictable methods in combination with the MD5 …8.2
• CVE-2024-24556urql is a GraphQL client that exposes a set of helpers for s…6.1
• CVE-2024-24557Moby is an open-source project created by Docker to enable s…7.8
• CVE-2024-24559Vyper is a Pythonic Smart Contract Language for the EVM. The…5.3
• CVE-2024-2456The Ecwid Ecommerce Shopping Cart plugin for WordPress is vu…6.4
• CVE-2024-24560Vyper is a Pythonic Smart Contract Language for the Ethereum…5.3
• CVE-2024-24561Vyper is a pythonic Smart Contract Language for the ethereum…9.8
• CVE-2024-24562vantage6-UI is the official user interface for the vantage6 …5.3
• CVE-2024-24563Vyper is a Pythonic Smart Contract Language for the Ethereum…9.8