CVE-2026-102989: TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses

An unauthenticated attacker can craft a URL to a server function in an affected TanStack Start app. If someone opens the link, the app can return attacker-controlled HTML from its own origin and run the attacker’s JavaScript there. The script can access same-origin data available to that visitor and make requests with their authority.