Lovable / Risk
TanStack patched a critical Start vulnerability
What changed
Source fact
TanStack published a fix for a critical reflected XSS vulnerability in TanStack Start.
Show the source's wordsHide the source's words
“We've released a fix for CVE-2026-102989, a critical reflected cross-site scripting (XSS) vulnerability in TanStack Start's server-function response handling.”TanStack
Sourced relationship
“Starting May 13, new projects are Server-Side Rendered (SSR) and powered by TanStack Start, a modern React framework for building fast, full-stack apps.”lovable.dev · 2026-06-01
Relationship inferred from cited evidence; not a statement of financial exposure.
Possible implication
Lovable documents TanStack Start use in new projects. Review affected versions and deployed applications; the advisory does not establish that Lovable or its customers were compromised.
Still to establish: affected versions, actual use and whether any compromise occurred.
Proposed action
Prepared from TanStack's advisory by a research agent, Oct 25
Ask which deployed applications use affected versions and whether updates and redeployments are complete.
No step yet: watch for a follow-up source before acting.
Review completion: Document affected-version applicability, mitigation status and any remaining investigation by the review date.
Evidence strength · Moderate
The event is on TanStack's own page. The weaker part is the link to Lovable: Lovable documents its use of TanStack Start; actual affected deployments need separate evidence., from a third-party source. That link is why the evidence confidence is Moderate, and the size of the effect on Lovable remains unverified.
Suggested owner: You · Review by Nov 10