Lovable Addresses TanStack Start Vulnerability
Lovable's security team discovered a vulnerability in TanStack Start, the framework powering Lovable apps, and has deployed firewall protections while a fix is prepared. Affected projects will be automatically updated the next time you make a change in Lovable, or you can apply the fix immediately through your project's Security page at no additional cost.
Not all Lovable projects were affected. If yours was, you'll receive an email notification.
What was found
On September 14, 2026, a security researcher identified the vulnerability while examining software libraries used by Lovable...
