CVE-2026-15607

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-15607

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-15607.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-15607

Published

2026-07-13T23:00:15.192Z

Modified

2026-07-17T03:41:38.925345840Z

Severity

2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

tanstack db Alias Path select.ts select prototype pollution

Details

A vulnerability was detected in tanstack db up to 0.6.8. Affected by this vulnerability is the function select of the file src/query/compiler/select.ts of the component Alias Path Handler. The manipulation results in improperly controlled modification of object prototype attributes. The attack may be launched remotely. The exploit is now public and may be used. The patch is identified as ac09b1177a100eafa85cba3cd09dd1f53f933ded. A patch should be applied to remediate this issue.

Database specific

{
    "cwe_ids": [
        "CWE-1321",
        "CWE-94"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/15xxx/CVE-2026-15607.json",
    "cna_assigner": "VulDB",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "0.6.0"
                },
                {
                    "last_affected": "0.6.0"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}

References

Affected packages

Git / github.com/tanstack/db

Affected ranges

Type

GIT

Repo

https://github.com/tanstack/db

Events

Introduced

caf51665ac233d40bfd5d72bb0159cd29591a5d6

Fixed

ac09b1177a100eafa85cba3cd09dd1f53f933ded

Database specific

{
    "extracted_events": [
        {
            "introduced": "0.6.1"
        },
        {
            "last_affected": "0.6.1"
        },
        {
            "introduced": "0.6.2"
        },
        {
            "last_affected": "0.6.2"
        },
        {
            "introduced": "0.6.3"
        },
        {
            "last_affected": "0.6.3"
        },
        {
            "introduced": "0.6.4"
        },
        {
            "last_affected": "0.6.4"
        },
        {
            "introduced": "0.6.5"
        },
        {
            "last_affected": "0.6.5"
        },
        {
            "introduced": "0.6.6"
        },
        {
            "last_affected": "0.6.6"
        },
        {
            "introduced": "0.6.7"
        },
        {
            "last_affected": "0.6.7"
        },
        {
            "introduced": "0.6.8"
        },
        {
            "last_affected": "0.6.8"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

0.*

0.6.1

0.6.2

0.6.3

0.6.4

0.6.5

0.6.6

0.6.7

0.6.8

@tanstack/angular-db@0.*

@tanstack/angular-db@0.1.61

@tanstack/angular-db@0.1.62

@tanstack/angular-db@0.1.63

@tanstack/angular-db@0.1.64

@tanstack/angular-db@0.1.65

@tanstack/angular-db@0.1.66

@tanstack/angular-db@0.1.67

@tanstack/angular-db@0.1.68

@tanstack/angular-db@0.1.69

@tanstack/angular-db@0.1.70

@tanstack/browser-db-sqlite-persistence@0.*

@tanstack/browser-db-sqlite-persistence@0.1.10

@tanstack/browser-db-sqlite-persistence@0.1.11

@tanstack/browser-db-sqlite-persistence@0.1.5

@tanstack/browser-db-sqlite-persistence@0.1.6

@tanstack/browser-db-sqlite-persistence@0.1.7

@tanstack/browser-db-sqlite-persistence@0.1.8

@tanstack/browser-db-sqlite-persistence@0.1.9

@tanstack/browser-db-sqlite-persistence@0.2.0

@tanstack/browser-db-sqlite-persistence@0.2.1

@tanstack/browser-db-sqlite-persistence@0.2.2

@tanstack/capacitor-db-sqlite-persistence@0.*

@tanstack/capacitor-db-sqlite-persistence@0.1.10

@tanstack/capacitor-db-sqlite-persistence@0.1.11

@tanstack/capacitor-db-sqlite-persistence@0.1.5

@tanstack/capacitor-db-sqlite-persistence@0.1.6

@tanstack/capacitor-db-sqlite-persistence@0.1.7

@tanstack/capacitor-db-sqlite-persistence@0.1.8

@tanstack/capacitor-db-sqlite-persistence@0.1.9

@tanstack/capacitor-db-sqlite-persistence@0.2.0

@tanstack/capacitor-db-sqlite-persistence@0.2.1

@tanstack/capacitor-db-sqlite-persistence@0.2.2

@tanstack/cloudflare-durable-objects-db-sqlite-persistence@0.*

@tanstack/cloudflare-durable-objects-db-sqlite-persistence@0.1.10

@tanstack/cloudflare-durable-objects-db-sqlite-persistence@0.1.11

@tanstack/cloudflare-durable-objects-db-sqlite-persistence@0.1.5

@tanstack/cloudflare-durable-objects-db-sqlite-persistence@0.1.6

@tanstack/cloudflare-durable-objects-db-sqlite-persistence@0.1.7

@tanstack/cloudflare-durable-objects-db-sqlite-persistence@0.1.8

@tanstack/cloudflare-durable-objects-db-sqlite-persistence@0.1.9

@tanstack/cloudflare-durable-objects-db-sqlite-persistence@0.2.0

@tanstack/cloudflare-durable-objects-db-sqlite-persistence@0.2.1

@tanstack/cloudflare-durable-objects-db-sqlite-persistence@0.2.2

@tanstack/db-sqlite-persistence-core@0.*

@tanstack/db-sqlite-persistence-core@0.1.10

@tanstack/db-sqlite-persistence-core@0.1.11

@tanstack/db-sqlite-persistence-core@0.1.5

@tanstack/db-sqlite-persistence-core@0.1.6

@tanstack/db-sqlite-persistence-core@0.1.7

@tanstack/db-sqlite-persistence-core@0.1.8

@tanstack/db-sqlite-persistence-core@0.1.9

@tanstack/db-sqlite-persistence-core@0.2.0

@tanstack/db-sqlite-persistence-core@0.2.1

@tanstack/db-sqlite-persistence-core@0.2.2

@tanstack/db@0.*

@tanstack/db@0.6.1

@tanstack/db@0.6.10

@tanstack/db@0.6.2

@tanstack/db@0.6.3

@tanstack/db@0.6.4

@tanstack/db@0.6.5

@tanstack/db@0.6.6

@tanstack/db@0.6.7

@tanstack/db@0.6.8

@tanstack/db@0.6.9

@tanstack/electric-db-collection@0.*

@tanstack/electric-db-collection@0.2.43

@tanstack/electric-db-collection@0.3.0

@tanstack/electric-db-collection@0.3.1

@tanstack/electric-db-collection@0.3.2

@tanstack/electric-db-collection@0.3.3

@tanstack/electric-db-collection@0.3.4

@tanstack/electric-db-collection@0.3.5

@tanstack/electric-db-collection@0.3.6

@tanstack/electric-db-collection@0.3.7

@tanstack/electric-db-collection@0.3.8

@tanstack/electron-db-sqlite-persistence@0.*

@tanstack/electron-db-sqlite-persistence@0.1.10

@tanstack/electron-db-sqlite-persistence@0.1.11

@tanstack/electron-db-sqlite-persistence@0.1.12

@tanstack/electron-db-sqlite-persistence@0.1.13

@tanstack/electron-db-sqlite-persistence@0.1.14

@tanstack/electron-db-sqlite-persistence@0.1.5

@tanstack/electron-db-sqlite-persistence@0.1.6

@tanstack/electron-db-sqlite-persistence@0.1.7

@tanstack/electron-db-sqlite-persistence@0.1.8

@tanstack/electron-db-sqlite-persistence@0.1.9

@tanstack/expo-db-sqlite-persistence@0.*

@tanstack/expo-db-sqlite-persistence@0.1.10

@tanstack/expo-db-sqlite-persistence@0.1.11

@tanstack/expo-db-sqlite-persistence@0.1.5

@tanstack/expo-db-sqlite-persistence@0.1.6

@tanstack/expo-db-sqlite-persistence@0.1.7

@tanstack/expo-db-sqlite-persistence@0.1.8

@tanstack/expo-db-sqlite-persistence@0.1.9

@tanstack/expo-db-sqlite-persistence@0.2.0

@tanstack/expo-db-sqlite-persistence@0.2.1

@tanstack/expo-db-sqlite-persistence@0.2.2

@tanstack/node-db-sqlite-persistence@0.*

@tanstack/node-db-sqlite-persistence@0.1.10

@tanstack/node-db-sqlite-persistence@0.1.11

@tanstack/node-db-sqlite-persistence@0.1.5

@tanstack/node-db-sqlite-persistence@0.1.6

@tanstack/node-db-sqlite-persistence@0.1.7

@tanstack/node-db-sqlite-persistence@0.1.8

@tanstack/node-db-sqlite-persistence@0.1.9

@tanstack/node-db-sqlite-persistence@0.2.0

@tanstack/node-db-sqlite-persistence@0.2.1

@tanstack/node-db-sqlite-persistence@0.2.2

@tanstack/offline-transactions@1.*

@tanstack/offline-transactions@1.0.26

@tanstack/offline-transactions@1.0.27

@tanstack/offline-transactions@1.0.28

@tanstack/offline-transactions@1.0.29

@tanstack/offline-transactions@1.0.30

@tanstack/offline-transactions@1.0.31

@tanstack/offline-transactions@1.0.32

@tanstack/offline-transactions@1.0.33

@tanstack/offline-transactions@1.0.34

@tanstack/offline-transactions@1.0.35

@tanstack/powersync-db-collection@0.*

@tanstack/powersync-db-collection@0.1.39

@tanstack/powersync-db-collection@0.1.40

@tanstack/powersync-db-collection@0.1.41

@tanstack/powersync-db-collection@0.1.42

@tanstack/powersync-db-collection@0.1.43

@tanstack/powersync-db-collection@0.1.44

@tanstack/powersync-db-collection@0.1.45

@tanstack/powersync-db-collection@0.1.46

@tanstack/powersync-db-collection@0.1.47

@tanstack/powersync-db-collection@0.1.48

@tanstack/query-db-collection@1.*

@tanstack/query-db-collection@1.0.32

@tanstack/query-db-collection@1.0.33

@tanstack/query-db-collection@1.0.34

@tanstack/query-db-collection@1.0.35

@tanstack/query-db-collection@1.0.36

@tanstack/query-db-collection@1.0.37

@tanstack/query-db-collection@1.0.38

@tanstack/query-db-collection@1.0.39

@tanstack/query-db-collection@1.0.40

@tanstack/query-db-collection@1.0.41

@tanstack/query-db-collection@1.0.42

@tanstack/react-db@0.*

@tanstack/react-db@0.1.79

@tanstack/react-db@0.1.80

@tanstack/react-db@0.1.81

@tanstack/react-db@0.1.82

@tanstack/react-db@0.1.83

@tanstack/react-db@0.1.84

@tanstack/react-db@0.1.85

@tanstack/react-db@0.1.86

@tanstack/react-db@0.1.87

@tanstack/react-db@0.1.88

@tanstack/react-native-db-sqlite-persistence@0.*

@tanstack/react-native-db-sqlite-persistence@0.1.10

@tanstack/react-native-db-sqlite-persistence@0.1.11

@tanstack/react-native-db-sqlite-persistence@0.1.5

@tanstack/react-native-db-sqlite-persistence@0.1.6

@tanstack/react-native-db-sqlite-persistence@0.1.7

@tanstack/react-native-db-sqlite-persistence@0.1.8

@tanstack/react-native-db-sqlite-persistence@0.1.9

@tanstack/react-native-db-sqlite-persistence@0.2.0

@tanstack/react-native-db-sqlite-persistence@0.2.1

@tanstack/react-native-db-sqlite-persistence@0.2.2

@tanstack/rxdb-db-collection@0.*

@tanstack/rxdb-db-collection@0.1.67

@tanstack/rxdb-db-collection@0.1.68

@tanstack/rxdb-db-collection@0.1.69

@tanstack/rxdb-db-collection@0.1.70

@tanstack/rxdb-db-collection@0.1.71

@tanstack/rxdb-db-collection@0.1.72

@tanstack/rxdb-db-collection@0.1.73

@tanstack/rxdb-db-collection@0.1.74

@tanstack/rxdb-db-collection@0.1.75

@tanstack/rxdb-db-collection@0.1.76

@tanstack/solid-db@0.*

@tanstack/solid-db@0.2.15

@tanstack/solid-db@0.2.16

@tanstack/solid-db@0.2.17

@tanstack/solid-db@0.2.18

@tanstack/solid-db@0.2.19

@tanstack/solid-db@0.2.20

@tanstack/solid-db@0.2.21

@tanstack/solid-db@0.2.22

@tanstack/solid-db@0.2.23

@tanstack/solid-db@0.2.24

@tanstack/svelte-db@0.*

@tanstack/svelte-db@0.1.78

@tanstack/svelte-db@0.1.79

@tanstack/svelte-db@0.1.80

@tanstack/svelte-db@0.1.81

@tanstack/svelte-db@0.1.82

@tanstack/svelte-db@0.1.83

@tanstack/svelte-db@0.1.84

@tanstack/svelte-db@0.1.85

@tanstack/svelte-db@0.1.86

@tanstack/svelte-db@0.1.87

@tanstack/tauri-db-sqlite-persistence@0.*

@tanstack/tauri-db-sqlite-persistence@0.1.10

@tanstack/tauri-db-sqlite-persistence@0.1.11

@tanstack/tauri-db-sqlite-persistence@0.1.5

@tanstack/tauri-db-sqlite-persistence@0.1.6

@tanstack/tauri-db-sqlite-persistence@0.1.7

@tanstack/tauri-db-sqlite-persistence@0.1.8

@tanstack/tauri-db-sqlite-persistence@0.1.9

@tanstack/tauri-db-sqlite-persistence@0.2.0

@tanstack/tauri-db-sqlite-persistence@0.2.1

@tanstack/tauri-db-sqlite-persistence@0.2.2

@tanstack/trailbase-db-collection@0.*

@tanstack/trailbase-db-collection@0.1.79

@tanstack/trailbase-db-collection@0.1.80

@tanstack/trailbase-db-collection@0.1.81

@tanstack/trailbase-db-collection@0.1.82

@tanstack/trailbase-db-collection@0.1.83

@tanstack/trailbase-db-collection@0.1.84

@tanstack/trailbase-db-collection@0.1.85

@tanstack/trailbase-db-collection@0.1.86

@tanstack/trailbase-db-collection@0.1.87

@tanstack/trailbase-db-collection@0.1.88

@tanstack/vue-db@0.*

@tanstack/vue-db@0.0.112

@tanstack/vue-db@0.0.113

@tanstack/vue-db@0.0.114

@tanstack/vue-db@0.0.115

@tanstack/vue-db@0.0.116

@tanstack/vue-db@0.0.117

@tanstack/vue-db@0.0.118

@tanstack/vue-db@0.0.119

@tanstack/vue-db@0.0.120

@tanstack/vue-db@0.0.121

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-15607.json"