A TanStack Start vulnerability, CVE-2026-102989 (CVSS 9.3), allows unauthenticated reflected XSS via crafted links. Upgrade to the patched packages.

#TanStack #TanStackStart #CVE2026102989 #ReflectedXSS #React #JavaScript #WebSecurity #CyberSecurity