Correction, October 13, 2026: Hosted firewall rules mitigate the attack while projects are updated. A dependency fix requires a patched version in the deployed build; a later fixed version also qualifies.

Lovable’s security team found a vulnerability in TanStack Start, a web framework that Lovable apps use. Lovable says it has already put protections in place for apps it hosts. If your app lives anywhere else, the protection does not reach it.

What happened

The flaw is tracked as CVE-2026-102989. A CVE is just a public ID number for a known security bug, so you can look it up. Lovable says a researcher on its security team spotted it on September 14, 2026, while examining the libraries that power Lovable apps. The team reported it to TanStack’s maintainers.

The bug is a cross-site scripting (XSS) problem. In plain terms, an attacker could craft a special link. When a visitor opened it, the affected app would run the attacker’s JavaScript inside that visitor’s browser. That code could reach information the visitor can see or act as them.

Lovable says exploitation needed both vulnerable server functionality and a user clicking the link. Using TanStack Start alone did not make every app exploitable. Lovable also says it found no evidence of exploitation in the logs it reviewed.

What Lovable did

While the maintainers prepared a fix, Lovable added firewall rules for apps hosted on Lovable. A firewall rule here means traffic matching the attack pattern gets blocked before it reaches your app.

Lovable says affected projects get upgraded automatically to the patched version the next time you make a change. If you would rather not make an edit just to trigger it, Lovable says you can apply the update for free from your project’s Security page. For an exported app, check TanStack’s patch notice before rebuilding and redeploying. It lists fixed versions for each Start package and requires the resolved @tanstack/start-server-core dependency to be 1.169.39 or later.

Lovable also says not every project was affected. If yours was, it says it will email you.

The gap that matters

The firewall protection only covers apps hosted on Lovable. Lovable’s post says that for apps hosted externally, you must apply the upstream TanStack Start patch yourself and redeploy.

That is the real risk for builders who export a Lovable project to another host. An exported deployment needs its own dependency-update and redeployment workflow. A working app does not establish that its dependencies are patched.

What to do next

  1. Check where your app runs. If it is published through Lovable, you can stop at the next two steps. If it runs on another host, keep going.
  2. Check for an email from Lovable. It is how the company says it will flag affected projects.
  3. Open your project’s Security page and apply the update if it is offered, rather than waiting for your next edit.
  4. For exported apps, ask your coding agent to do the upgrade. Try this prompt: “Check which version of TanStack Start this project uses. Compare it with the patched version named in TanStack’s security advisory for CVE-2026-102989. Upgrade it, run the build, and tell me what changed.” Then redeploy. Assign someone to receive security notices and apply future updates.

To confirm the dependency update, ask the agent to print the resolved package versions and check that they fall within TanStack’s fixed ranges. Then rebuild and redeploy. Updating the local installation alone does not patch an already deployed app.

End of article