On 2026-05-11

#!/usr/bin/env python3
# CVE-2026-45321 TanStack verifier
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import json
import os
import re
import sys
from pathlib import Path

BAD = {
    "@tanstack/arktype-adapter": {"1.166.12", "1.166.15"},
    "@tanstack/eslint-plugin-router": {"1.161.9", "1.161.12"},
    "@tanstack/eslint-plugin-start": {"0.0.4", "0.0.7"},
    "@tanstack/history": {"1.161.9", "1.161.12"},
    "@tanstack/nitro-v2-vite-plugin": {"1.154.12", "1.154.15"},
    "@tanstack/react-router": {"1.169.5", "1.169.8"},
    "@tanstack/react-router-devtools": {"1.166.16", "1.166.19"},
    "@tanstack/react-router-ssr-query": {"1.166.15", "1.166.18"},
    "@tanstack/react-start": {"1.167.68", "1.167.71"},
    "@tanstack/react-start-client": {"1.166.51", "1.166.54"},
    "@tanstack/react-start-rsc": {"0.0.47", "0.0.50"},
    "@tanstack/react-start-server": {"1.166.55", "1.166.58"},
    "@tanstack/router-cli": {"1.166.46", "1.166.49"},
    "@tanstack/router-core": {"1.169.5", "1.169.8"},
    "@tanstack/router-devtools": {"1.166.16", "1.166.19"},
    "@tanstack/router-devtools-core": {"1.167.6", "1.167.9"},
    "@tanstack/router-generator": {"1.166.45", "1.166.48"},
    "@tanstack/router-plugin": {"1.167.38", "1.167.41"},
    "@tanstack/router-ssr-query-core": {"1.168.3", "1.168.6"},
    "@tanstack/router-utils": {"1.161.11", "1.161.14"},
    "@tanstack/router-vite-plugin": {"1.166.53", "1.166.56"},
    "@tanstack/solid-router": {"1.169.5", "1.169.8"},
    "@tanstack/solid-router-devtools": {"1.166.16", "1.166.19"},
    "@tanstack/solid-router-ssr-query": {"1.166.15", "1.166.18"},
    "@tanstack/solid-start": {"1.167.65", "1.167.68"},
    "@tanstack/solid-start-client": {"1.166.50", "1.166.53"},
    "@tanstack/solid-start-server": {"1.166.54", "1.166.57"},
    "@tanstack/start-client-core": {"1.168.5", "1.168.8"},
    "@tanstack/start-fn-stubs": {"1.161.9", "1.161.12"},
    "@tanstack/start-plugin-core": {"1.169.23", "1.169.26"},
    "@tanstack/start-server-core": {"1.167.33", "1.167.36"},
    "@tanstack/start-static-server-functions": {"1.166.44", "1.166.47"},
    "@tanstack/start-storage-context": {"1.166.38", "1.166.41"},
    "@tanstack/valibot-adapter": {"1.166.12", "1.166.15"},
    "@tanstack/virtual-file-routes": {"1.161.10", "1.161.13"},
    "@tanstack/vue-router": {"1.169.5", "1.169.8"},
    "@tanstack/vue-router-devtools": {"1.166.16", "1.166.19"},
    "@tanstack/vue-router-ssr-query": {"1.166.15", "1.166.18"},
    "@tanstack/vue-start": {"1.167.61", "1.167.64"},
    "@tanstack/vue-start-client": {"1.166.46", "1.166.49"},
    "@tanstack/vue-start-server": {"1.166.50", "1.166.53"},
    "@tanstack/zod-adapter": {"1.166.12", "1.166.15"}
}

IOC_REF = "github:tanstack/router#79ac49eedf774dd4b0cfa308722bc463cfe5885c"
IOC_FILE = "router_init.js"
findings = []
files_scanned = 0


def add(kind, path, detail):
    findings.append({"kind": kind, "path": str(path), "detail": detail})


def check_name_version(name, version, path, source):
    if name in BAD and version in BAD[name]:
        add(source, path, f"{name}@{version}")


def walk_json(obj, path, source):
    if isinstance(obj, dict):
        name = obj.get("name")
        version = obj.get("version")
        if isinstance(name, str) and isinstance(version, str):
            check_name_version(name, version, path, source)
        if "optionalDependencies" in obj and isinstance(obj["optionalDependencies"], dict):
            if obj["optionalDependencies"].get("@tanstack/setup") == IOC_REF:
                add(source, path, "malicious optionalDependencies IOC")
        for v in obj.values():
            walk_json(v, path, source)
    elif isinstance(obj, list):
        for v in obj:
            walk_json(v, path, source)


def scan_package_lock(path):
    global files_scanned
    files_scanned += 1
    try:
        data = json.loads(path.read_text(encoding="utf-8", errors="ignore"))
        walk_json(data, path, "lockfile")
        packages = data.get("packages") if isinstance(data, dict) else None
        if isinstance(packages, dict):
            for meta in packages.values():
                if isinstance(meta, dict):
                    name = meta.get("name")
                    version = meta.get("version")
                    if isinstance(name, str) and isinstance(version, str):
                        check_name_version(name, version, path, "lockfile")
    except Exception as e:
        add("error", path, f"package-lock parse failed: {e}")


def scan_text_lock(path):
    global files_scanned
    files_scanned += 1
    try:
        txt = path.read_text(encoding="utf-8", errors="ignore")
        if IOC_REF in txt:
            add("lockfile", path, "malicious git ref IOC")
        for pkg, versions in BAD.items():
            for ver in versions:
                patterns = [
                    re.escape(f"{pkg}@{ver}"),
                    re.escape(f"{pkg}@npm:{ver}"),
                    re.escape(f"/{pkg}@{ver}"),
                    re.escape(f"'{pkg}@{ver}'"),
                    re.escape(f'"{pkg}@{ver}"')
                ]
                if any(re.search(p, txt) for p in patterns):
                    add("lockfile", path, f"{pkg}@{ver}")
    except Exception as e:
        add("error", path, f"text lock parse failed: {e}")


def scan_package_json(path):
    global files_scanned
    files_scanned += 1
    try:
        data = json.loads(path.read_text(encoding="utf-8", errors="ignore"))
        name = data.get("name")
        version = data.get("version")
        if isinstance(name, str) and isinstance(version, str):
            check_name_version(name, version, path, "manifest")
        opt = data.get("optionalDependencies")
        if isinstance(opt, dict) and opt.get("@tanstack/setup") == IOC_REF:
            add("manifest", path, "malicious optionalDependencies IOC")
    except Exception as e:
        add("error", path, f"package.json parse failed: {e}")


def scan_router_init(path):
    global files_scanned
    files_scanned += 1
    try:
        if path.name == IOC_FILE and path.stat().st_size > 1024 * 1024:
            add("file", path, "router_init.js present and >1MB")
    except Exception as e:
        add("error", path, f"router_init stat failed: {e}")


def main():
    root = Path(sys.argv[1]) if len(sys.argv) > 1 else Path.cwd()
    if not root.exists():
        print("UNKNOWN - path does not exist")
        sys.exit(2)

    for p in root.rglob("*"):
        if not p.is_file():
            continue
        name = p.name
        if name in {"package-lock.json", "npm-shrinkwrap.json"}:
            scan_package_lock(p)
        elif name in {"pnpm-lock.yaml", "yarn.lock"}:
            scan_text_lock(p)
        elif name == "package.json":
            scan_package_json(p)
        elif name == IOC_FILE:
            scan_router_init(p)

    real_findings = [f for f in findings if f["kind"] != "error"]
    errors = [f for f in findings if f["kind"] == "error"]

    if real_findings:
        print("VULNERABLE")
        for f in real_findings[:100]:
            print(f"- {f['kind']}: {f['path']} :: {f['detail']}")
        if errors:
            print(f"- note: {len(errors)} parse/stat errors encountered")
        sys.exit(1)

    if files_scanned == 0:
        print("UNKNOWN - no relevant Node lockfiles or manifests found")
        sys.exit(2)

    if errors and files_scanned < len(errors):
        print("UNKNOWN - only errors encountered during scan")
        sys.exit(2)

    print("PATCHED")
    print(f"Scanned {files_scanned} relevant files under {root}")
    if errors:
        print(f"Note: {len(errors)} non-fatal parse/stat errors encountered")
    sys.exit(0)


if __name__ == "__main__":
    main()