Lovable finds TanStack Start flaw, shields hosted apps with firewall rules

What the researcher found

According to Lovable, a security researcher on its security team identified the vulnerability on September 14, 2026, while examining software libraries that power Lovable apps. The company describes his job as thinking like an attacker, actively trying to break the software behind apps so weaknesses can be found and addressed.

Lovable says the flaw could allow an attacker to use a specially crafted link to make an affected app run unwanted JavaScript in a visitor's browser. That code could access information available to the visitor or perform actions with their permissions inside the app.

The attack required two conditions: affected server functionality and a visitor opening the malicious link. Lovable states that using TanStack Start did not, by itself, make every app exploitable, and that not all Lovable projects were impacted. The company says it has not found evidence of exploitation in the logs it has reviewed. Affected project owners will be contacted by email.

Firewall rules while the fix was prepared

Lovable submitted a vulnerability report to TanStack on September 14. After that, it began enforcing firewall rules designed to block exploitation attempts in hosted apps. The company says it kept testing and refining the rules to improve coverage and avoid blocking legitimate requests.

Because the apps run on Lovable, the company says it could deploy the protections without waiting for users to read a security alert or change a setting. One patch from its team could reach hosted apps across the platform. Lovable also says it coordinated disclosure with TanStack's maintainers, giving them time to address the issue before technical details became public.

How the update reaches projects

Lovable says the fix is built into its normal workflow. The next time a user makes a change to an affected project, the coding agent automatically upgrades TanStack Start to the patched version. Users do not have to identify the package or work out how to update it.

• Users who want the fix before building further can apply it through the project's Security page at no credit cost.
• New projects use the patched version from the start.
• The firewall protections stay in place while existing projects are updated.

The company adds that its security scanner offers a way to find and fix the affected dependency without making other changes.

What it means for users

For apps hosted on Lovable, the firewall protections are already active. To update the affected software, users can make their next change in Lovable or apply the fix from the Security page for free.

Apps hosted elsewhere are not covered. Lovable says those owners should apply the upstream security update and redeploy through their own hosting setup. Customers with questions can contact Lovable Support.

Lovable also says its research helps beyond its own platform: by reporting the issue to TanStack's maintainers, its team helped bring a fix to the wider community using the framework. The company says its security testing covers the third-party software Lovable depends on, from reporting a flaw to protecting the apps that use it.