{"id":"CVE-2026-15607","summary":"tanstack db Alias Path select.ts select prototype pollution","details":"A vulnerability was detected in tanstack db up to 0.6.8. Affected by this vulnerability is the function select of the file src/query/compiler/select.ts of the component Alias Path Handler. The manipulation results in improperly controlled modification of object prototype attributes. The attack may be launched remotely. The exploit is now public and may be used. The patch is identified as ac09b1177a100eafa85cba3cd09dd1f53f933ded. A patch should be applied to remediate this issue.","modified":"2026-07-17T03:41:38.925345840Z","published":"2026-07-13T23:00:15.192Z","database_specific":{"unresolved_ranges":[{"extracted_events":[{"introduced":"0.6.0"},{"last_affected":"0.6.0"}],"source":"AFFECTED_FIELD"}],"cna_assigner":"VulDB","cwe_ids":["CWE-1321","CWE-94"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/15xxx/CVE-2026-15607.json"},"references":[{"type":"WEB","url":"https://github.com/TanStack/db/"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/15xxx/CVE-2026-15607.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15607"},{"type":"ADVISORY","url":"https://vuldb.com/cve/CVE-2026-15607"},{"type":"ADVISORY","url":"https://vuldb.com/submit/855677"},{"type":"ADVISORY","url":"https://vuldb.com/vuln/378115"},{"type":"REPORT","url":"https://github.com/TanStack/db/issues/1584"},{"type":"REPORT","url":"https://vuldb.com/vuln/378115/cti"},{"type":"FIX","url":"https://github.com/TanStack/db/commit/ac09b1177a100eafa85cba3cd09dd1f53f933ded"},{"type":"FIX","url":"https://github.com/TanStack/db/pull/1595"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/tanstack/db","events":[{"introduced":"caf51665ac233d40bfd5d72bb0159cd29591a5d6"},{"fixed":"ac09b1177a100eafa85cba3cd09dd1f53f933ded"}],"database_specific":{"source":["AFFECTED_FIELD","REFERENCES"],"extracted_events":[{"introduced":"0.6.1"},{"last_affected":"0.6.1"},{"introduced":"0.6.2"},{"last_affected":"0.6.2"},{"introduced":"0.6.3"},{"last_affected":"0.6.3"},{"introduced":"0.6.4"},{"last_affected":"0.6.4"},{"introduced":"0.6.5"},{"last_affected":"0.6.5"},{"introduced":"0.6.6"},{"last_affected":"0.6.6"},{"introduced":"0.6.7"},{"last_affected":"0.6.7"},{"introduced":"0.6.8"},{"last_affected":"0.6.8"}]}}],"versions":["0.6.1","0.6.2","0.6.3","0.6.4","0.6.5","0.6.6","0.6.7","0.6.8","@tanstack/vue-db@0.0.121","@tanstack/trailbase-db-collection@0.1.88","@tanstack/tauri-db-sqlite-persistence@0.2.2","@tanstack/svelte-db@0.1.87","@tanstack/solid-db@0.2.24","@tanstack/rxdb-db-collection@0.1.76","@tanstack/react-native-db-sqlite-persistence@0.2.2","@tanstack/react-db@0.1.88","@tanstack/query-db-collection@1.0.42","@tanstack/powersync-db-collection@0.1.48","@tanstack/offline-transactions@1.0.35","@tanstack/node-db-sqlite-persistence@0.2.2","@tanstack/expo-db-sqlite-persistence@0.2.2","@tanstack/electron-db-sqlite-persistence@0.1.14","@tanstack/electric-db-collection@0.3.8","@tanstack/db@0.6.10","@tanstack/db-sqlite-persistence-core@0.2.2","@tanstack/cloudflare-durable-objects-db-sqlite-persistence@0.2.2","@tanstack/capacitor-db-sqlite-persistence@0.2.2","@tanstack/browser-db-sqlite-persistence@0.2.2","@tanstack/angular-db@0.1.70","@tanstack/vue-db@0.0.120","@tanstack/trailbase-db-collection@0.1.87","@tanstack/tauri-db-sqlite-persistence@0.2.1","@tanstack/svelte-db@0.1.86","@tanstack/solid-db@0.2.23","@tanstack/rxdb-db-collection@0.1.75","@tanstack/react-native-db-sqlite-persistence@0.2.1","@tanstack/react-db@0.1.87","@tanstack/query-db-collection@1.0.41","@tanstack/powersync-db-collection@0.1.47","@tanstack/offline-transactions@1.0.34","@tanstack/node-db-sqlite-persistence@0.2.1","@tanstack/expo-db-sqlite-persistence@0.2.1","@tanstack/electron-db-sqlite-persistence@0.1.13","@tanstack/electric-db-collection@0.3.7","@tanstack/db@0.6.9","@tanstack/db-sqlite-persistence-core@0.2.1","@tanstack/cloudflare-durable-objects-db-sqlite-persistence@0.2.1","@tanstack/capacitor-db-sqlite-persistence@0.2.1","@tanstack/browser-db-sqlite-persistence@0.2.1","@tanstack/angular-db@0.1.69","@tanstack/query-db-collection@1.0.40","@tanstack/vue-db@0.0.119","@tanstack/trailbase-db-collection@0.1.86","@tanstack/tauri-db-sqlite-persistence@0.2.0","@tanstack/svelte-db@0.1.85","@tanstack/solid-db@0.2.22","@tanstack/rxdb-db-collection@0.1.74","@tanstack/react-native-db-sqlite-persistence@0.2.0","@tanstack/react-db@0.1.86","@tanstack/query-db-collection@1.0.39","@tanstack/powersync-db-collection@0.1.46","@tanstack/offline-transactions@1.0.33","@tanstack/node-db-sqlite-persistence@0.2.0","@tanstack/expo-db-sqlite-persistence@0.2.0","@tanstack/electron-db-sqlite-persistence@0.1.12","@tanstack/electric-db-collection@0.3.6","@tanstack/db@0.6.8","@tanstack/db-sqlite-persistence-core@0.2.0","@tanstack/cloudflare-durable-objects-db-sqlite-persistence@0.2.0","@tanstack/capacitor-db-sqlite-persistence@0.2.0","@tanstack/browser-db-sqlite-persistence@0.2.0","@tanstack/angular-db@0.1.68","@tanstack/vue-db@0.0.118","@tanstack/trailbase-db-collection@0.1.85","@tanstack/tauri-db-sqlite-persistence@0.1.11","@tanstack/svelte-db@0.1.84","@tanstack/solid-db@0.2.21","@tanstack/rxdb-db-collection@0.1.73","@tanstack/react-native-db-sqlite-persistence@0.1.11","@tanstack/react-db@0.1.85","@tanstack/query-db-collection@1.0.38","@tanstack/powersync-db-collection@0.1.45","@tanstack/offline-transactions@1.0.32","@tanstack/node-db-sqlite-persistence@0.1.11","@tanstack/expo-db-sqlite-persistence@0.1.11","@tanstack/electron-db-sqlite-persistence@0.1.11","@tanstack/electric-db-collection@0.3.5","@tanstack/db@0.6.7","@tanstack/db-sqlite-persistence-core@0.1.11","@tanstack/cloudflare-durable-objects-db-sqlite-persistence@0.1.11","@tanstack/capacitor-db-sqlite-persistence@0.1.11","@tanstack/browser-db-sqlite-persistence@0.1.11","@tanstack/angular-db@0.1.67","@tanstack/vue-db@0.0.117","@tanstack/trailbase-db-collection@0.1.84","@tanstack/tauri-db-sqlite-persistence@0.1.10","@tanstack/svelte-db@0.1.83","@tanstack/solid-db@0.2.20","@tanstack/rxdb-db-collection@0.1.72","@tanstack/react-native-db-sqlite-persistence@0.1.10","@tanstack/react-db@0.1.84","@tanstack/query-db-collection@1.0.37","@tanstack/powersync-db-collection@0.1.44","@tanstack/offline-transactions@1.0.31","@tanstack/node-db-sqlite-persistence@0.1.10","@tanstack/expo-db-sqlite-persistence@0.1.10","@tanstack/electron-db-sqlite-persistence@0.1.10","@tanstack/electric-db-collection@0.3.4","@tanstack/db@0.6.6","@tanstack/db-sqlite-persistence-core@0.1.10","@tanstack/cloudflare-durable-objects-db-sqlite-persistence@0.1.10","@tanstack/capacitor-db-sqlite-persistence@0.1.10","@tanstack/browser-db-sqlite-persistence@0.1.10","@tanstack/angular-db@0.1.66","@tanstack/vue-db@0.0.116","@tanstack/trailbase-db-collection@0.1.83","@tanstack/tauri-db-sqlite-persistence@0.1.9","@tanstack/svelte-db@0.1.82","@tanstack/solid-db@0.2.19","@tanstack/rxdb-db-collection@0.1.71","@tanstack/react-native-db-sqlite-persistence@0.1.9","@tanstack/react-db@0.1.83","@tanstack/query-db-collection@1.0.36","@tanstack/powersync-db-collection@0.1.43","@tanstack/offline-transactions@1.0.30","@tanstack/node-db-sqlite-persistence@0.1.9","@tanstack/expo-db-sqlite-persistence@0.1.9","@tanstack/electron-db-sqlite-persistence@0.1.9","@tanstack/electric-db-collection@0.3.3","@tanstack/db@0.6.5","@tanstack/db-sqlite-persistence-core@0.1.9","@tanstack/cloudflare-durable-objects-db-sqlite-persistence@0.1.9","@tanstack/capacitor-db-sqlite-persistence@0.1.9","@tanstack/browser-db-sqlite-persistence@0.1.9","@tanstack/angular-db@0.1.65","@tanstack/vue-db@0.0.115","@tanstack/trailbase-db-collection@0.1.82","@tanstack/tauri-db-sqlite-persistence@0.1.8","@tanstack/svelte-db@0.1.81","@tanstack/solid-db@0.2.18","@tanstack/rxdb-db-collection@0.1.70","@tanstack/react-native-db-sqlite-persistence@0.1.8","@tanstack/react-db@0.1.82","@tanstack/query-db-collection@1.0.35","@tanstack/powersync-db-collection@0.1.42","@tanstack/offline-transactions@1.0.29","@tanstack/node-db-sqlite-persistence@0.1.8","@tanstack/expo-db-sqlite-persistence@0.1.8","@tanstack/electron-db-sqlite-persistence@0.1.8","@tanstack/electric-db-collection@0.3.2","@tanstack/db@0.6.4","@tanstack/db-sqlite-persistence-core@0.1.8","@tanstack/cloudflare-durable-objects-db-sqlite-persistence@0.1.8","@tanstack/capacitor-db-sqlite-persistence@0.1.8","@tanstack/browser-db-sqlite-persistence@0.1.8","@tanstack/angular-db@0.1.64","@tanstack/vue-db@0.0.114","@tanstack/trailbase-db-collection@0.1.81","@tanstack/tauri-db-sqlite-persistence@0.1.7","@tanstack/svelte-db@0.1.80","@tanstack/solid-db@0.2.17","@tanstack/rxdb-db-collection@0.1.69","@tanstack/react-native-db-sqlite-persistence@0.1.7","@tanstack/react-db@0.1.81","@tanstack/query-db-collection@1.0.34","@tanstack/powersync-db-collection@0.1.41","@tanstack/offline-transactions@1.0.28","@tanstack/node-db-sqlite-persistence@0.1.7","@tanstack/expo-db-sqlite-persistence@0.1.7","@tanstack/electron-db-sqlite-persistence@0.1.7","@tanstack/electric-db-collection@0.3.1","@tanstack/db@0.6.3","@tanstack/db-sqlite-persistence-core@0.1.7","@tanstack/cloudflare-durable-objects-db-sqlite-persistence@0.1.7","@tanstack/capacitor-db-sqlite-persistence@0.1.7","@tanstack/browser-db-sqlite-persistence@0.1.7","@tanstack/angular-db@0.1.63","@tanstack/vue-db@0.0.113","@tanstack/trailbase-db-collection@0.1.80","@tanstack/tauri-db-sqlite-persistence@0.1.6","@tanstack/svelte-db@0.1.79","@tanstack/solid-db@0.2.16","@tanstack/rxdb-db-collection@0.1.68","@tanstack/react-native-db-sqlite-persistence@0.1.6","@tanstack/react-db@0.1.80","@tanstack/query-db-collection@1.0.33","@tanstack/powersync-db-collection@0.1.40","@tanstack/offline-transactions@1.0.27","@tanstack/node-db-sqlite-persistence@0.1.6","@tanstack/expo-db-sqlite-persistence@0.1.6","@tanstack/electron-db-sqlite-persistence@0.1.6","@tanstack/electric-db-collection@0.3.0","@tanstack/db@0.6.2","@tanstack/db-sqlite-persistence-core@0.1.6","@tanstack/cloudflare-durable-objects-db-sqlite-persistence@0.1.6","@tanstack/capacitor-db-sqlite-persistence@0.1.6","@tanstack/browser-db-sqlite-persistence@0.1.6","@tanstack/angular-db@0.1.62","@tanstack/vue-db@0.0.112","@tanstack/trailbase-db-collection@0.1.79","@tanstack/tauri-db-sqlite-persistence@0.1.5","@tanstack/svelte-db@0.1.78","@tanstack/solid-db@0.2.15","@tanstack/rxdb-db-collection@0.1.67","@tanstack/react-native-db-sqlite-persistence@0.1.5","@tanstack/react-db@0.1.79","@tanstack/query-db-collection@1.0.32","@tanstack/powersync-db-collection@0.1.39","@tanstack/offline-transactions@1.0.26","@tanstack/node-db-sqlite-persistence@0.1.5","@tanstack/expo-db-sqlite-persistence@0.1.5","@tanstack/electron-db-sqlite-persistence@0.1.5","@tanstack/electric-db-collection@0.2.43","@tanstack/db@0.6.1","@tanstack/db-sqlite-persistence-core@0.1.5","@tanstack/cloudflare-durable-objects-db-sqlite-persistence@0.1.5","@tanstack/capacitor-db-sqlite-persistence@0.1.5","@tanstack/browser-db-sqlite-persistence@0.1.5","@tanstack/angular-db@0.1.61"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-15607.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P"}]}