altair-graphql Altair up to 8.5.7 Iframe Sandbox inject.ts injectScript scriptUrls cross site scripting

Summaryinfo

A vulnerability classified as problematic was found in altair-graphql Altair up to 8.5.7. This vulnerability affects the function injectScript of the file packages/altair-core/src/utils/inject.ts of the component Iframe Sandbox. The manipulation of the argument scriptUrls results in cross site scripting. This vulnerability is identified as CVE-2026-110802. The attack can be executed remotely. There is not any exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability classified as problematic has been found in altair-graphql Altair up to 8.5.7. Affected is the function injectScript of the file packages/altair-core/src/utils/inject.ts of the component Iframe Sandbox. The manipulation of the argument scriptUrls with an unknown input leads to a cross site scripting vulnerability. CWE is classifying the issue as CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. This is going to have an impact on integrity. CVE summarizes:

Altair is a GraphQL client for all platforms. From 7.2.4 until 8.5.8, packages/altair-iframe-sandbox/src/main.ts reads plugin_sandbox_opts from the iframe-sandbox query string and passes attacker-controlled scriptUrls to injectScript() in packages/altair-core/src/utils/inject.ts, which creates script elements in the page. The intended parent iframe flow places the page in an iframe with sandbox allow-scripts and without allow-same-origin, but direct navigation to a crafted iframe-sandbox URL omits that isolation and executes the supplied script in the origin serving Altair. Exploitation requires a victim to open the crafted URL, and the resulting script can access script-readable storage and make same-origin requests according to the deployment's authentication and cookie controls. This issue is fixed in version 8.5.8.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-110802 since 10/14/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1059.007.

Upgrading to version 8.5.8 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• altair-graphql

Name

• Altair

Version

• 8.5.0
• 8.5.1
• 8.5.2
• 8.5.3
• 8.5.4
• 8.5.5
• 8.5.6
• 8.5.7

Website

• Product: https://github.com/altair-graphql/altair/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion