Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-110802— Altair: DOM-based XSS via attacker-controlled script URLs in the iframe sandbox

Quick assessment

Affected
altair-graphql altair
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Altair 是一个支持所有平台的 GraphQL 客户端。在 7.2.4 至 8.5.8 版本中， 会从 查询字符串中读取 参数，并将攻击者控制的 传递给 中的 函数，该函数会在页面中创建 元素。 原本的设计流程是将页面嵌入到一个具有 但不包含 的 iframe 中，从而实现隔离。然而，如果直接导航到经过篡改的 URL，则会绕过该隔离机制，导致攻击者提供的脚本在托管 Altair 的源（origin）中执行。 利用此漏洞需要受害者打开特制的 URL。执行后的脚本可以访问可被脚本读取的存储区域，并根据部署环境的身份

CVSS 6.1 · Medium
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-110802

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Altair: DOM-based XSS via attacker-controlled script URLs in the iframe sandbox
Source: CVE Program / CVE List V5
Vulnerability Description
Altair is a GraphQL client for all platforms. From 7.2.4 until 8.5.8, packages/altair-iframe-sandbox/src/main.ts reads plugin_sandbox_opts from the iframe-sandbox query string and passes attacker-controlled scriptUrls to injectScript() in packages/altair-core/src/utils/inject.ts, which creates script elements in the page. The intended parent iframe flow places the page in an iframe with sandbox allow-scripts and without allow-same-origin, but direct navigation to a crafted iframe-sandbox URL omits that isolation and executes the supplied script in the origin serving Altair. Exploitation requires a victim to open the crafted URL, and the resulting script can access script-readable storage and make same-origin requests according to the deployment's authentication and cookie controls. This issue is fixed in version 8.5.8.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
altair-graphql altair >= 7.2.4, < 8.5.8 -
altair-graphql altair-express-middleware >= 7.2.4, < 8.5.8 -
altair-graphql altair-fastify-plugin >= 7.2.4, < 8.5.8 -
altair-graphql altair-koa-middleware >= 7.2.4, < 8.5.8 -
altair-graphql altair-static >= 7.2.4, < 8.5.8 -

II. Public POCs for CVE-2026-110802

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-110802

请登录查看更多情报信息。

Other References for CVE-2026-110802 (4)

IV. Related Vulnerabilities

Same product: altair
Same vendor: altair-graphql
Same weakness: CWE-79