CVE-2026-110802

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-110802", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-10-14T17:40:14.920Z", "datePublished": "2026-11-05T20:41:52.499Z", "dateUpdated": "2026-11-10T04:18:28.735Z"}, "containers": {"cna": {"title": "Altair: DOM-based XSS via attacker-controlled script URLs in the iframe sandbox", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-829", "lang": "en", "description": "CWE-829: Inclusion of Functionality from Untrusted Control Sphere", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/altair-graphql/altair/security/advisories/GHSA-752m-7p75-49gf", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/altair-graphql/altair/security/advisories/GHSA-752m-7p75-49gf"}, {"name": "https://github.com/altair-graphql/altair/commit/53a19183ce11ca147bb990c355e14ecb1dd7cd3e", "tags": ["x_refsource_MISC"], "url": "https://github.com/altair-graphql/altair/commit/53a19183ce11ca147bb990c355e14ecb1dd7cd3e"}, {"name": "https://github.com/altair-graphql/altair/commit/bdf422bdaaaf3186170ba7f22e22c259072133d9", "tags": ["x_refsource_MISC"], "url": "https://github.com/altair-graphql/altair/commit/bdf422bdaaaf3186170ba7f22e22c259072133d9"}, {"name": "https://github.com/altair-graphql/altair/releases/tag/v8.5.8", "tags": ["x_refsource_MISC"], "url": "https://github.com/altair-graphql/altair/releases/tag/v8.5.8"}], "affected": [{"vendor": "altair-graphql", "product": "altair", "versions": [{"version": ">= 7.2.4, < 8.5.8", "status": "affected"}]}, {"vendor": "altair-graphql", "product": "altair-express-middleware", "versions": [{"version": ">= 7.2.4, < 8.5.8", "status": "affected"}]}, {"vendor": "altair-graphql", "product": "altair-fastify-plugin", "versions": [{"version": ">= 7.2.4, < 8.5.8", "status": "affected"}]}, {"vendor": "altair-graphql", "product": "altair-koa-middleware", "versions": [{"version": ">= 7.2.4, < 8.5.8", "status": "affected"}]}, {"vendor": "altair-graphql", "product": "altair-static", "versions": [{"version": ">= 7.2.4, < 8.5.8", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-11-05T20:41:52.499Z"}, "descriptions": [{"lang": "en", "value": "Altair is a GraphQL client for all platforms. From 7.2.4 until 8.5.8, packages/altair-iframe-sandbox/src/main.ts reads plugin_sandbox_opts from the iframe-sandbox query string and passes attacker-controlled scriptUrls to injectScript() in packages/altair-core/src/utils/inject.ts, which creates script elements in the page. The intended parent iframe flow places the page in an iframe with sandbox allow-scripts and without allow-same-origin, but direct navigation to a crafted iframe-sandbox URL omits that isolation and executes the supplied script in the origin serving Altair. Exploitation requires a victim to open the crafted URL, and the resulting script can access script-readable storage and make same-origin requests according to the deployment's authentication and cookie controls. This issue is fixed in version 8.5.8."}], "source": {"advisory": "GHSA-752m-7p75-49gf", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/altair-graphql/altair/security/advisories/GHSA-752m-7p75-49gf", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-10T04:16:25.942801Z", "id": "CVE-2026-110802", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-10T04:18:28.735Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-110802", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-10-14T17:40:14.920Z", "datePublished": "2026-11-05T20:41:52.499Z", "dateUpdated": "2026-11-10T04:18:28.735Z"}, "containers": {"cna": {"title": "Altair: DOM-based XSS via attacker-controlled script URLs in the iframe sandbox", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-829", "lang": "en", "description": "CWE-829: Inclusion of Functionality from Untrusted Control Sphere", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/altair-graphql/altair/security/advisories/GHSA-752m-7p75-49gf", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/altair-graphql/altair/security/advisories/GHSA-752m-7p75-49gf"}, {"name": "https://github.com/altair-graphql/altair/commit/53a19183ce11ca147bb990c355e14ecb1dd7cd3e", "tags": ["x_refsource_MISC"], "url": "https://github.com/altair-graphql/altair/commit/53a19183ce11ca147bb990c355e14ecb1dd7cd3e"}, {"name": "https://github.com/altair-graphql/altair/commit/bdf422bdaaaf3186170ba7f22e22c259072133d9", "tags": ["x_refsource_MISC"], "url": "https://github.com/altair-graphql/altair/commit/bdf422bdaaaf3186170ba7f22e22c259072133d9"}, {"name": "https://github.com/altair-graphql/altair/releases/tag/v8.5.8", "tags": ["x_refsource_MISC"], "url": "https://github.com/altair-graphql/altair/releases/tag/v8.5.8"}], "affected": [{"vendor": "altair-graphql", "product": "altair", "versions": [{"version": ">= 7.2.4, < 8.5.8", "status": "affected"}]}, {"vendor": "altair-graphql", "product": "altair-express-middleware", "versions": [{"version": ">= 7.2.4, < 8.5.8", "status": "affected"}]}, {"vendor": "altair-graphql", "product": "altair-fastify-plugin", "versions": [{"version": ">= 7.2.4, < 8.5.8", "status": "affected"}]}, {"vendor": "altair-graphql", "product": "altair-koa-middleware", "versions": [{"version": ">= 7.2.4, < 8.5.8", "status": "affected"}]}, {"vendor": "altair-graphql", "product": "altair-static", "versions": [{"version": ">= 7.2.4, < 8.5.8", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-11-05T20:41:52.499Z"}, "descriptions": [{"lang": "en", "value": "Altair is a GraphQL client for all platforms. From 7.2.4 until 8.5.8, packages/altair-iframe-sandbox/src/main.ts reads plugin_sandbox_opts from the iframe-sandbox query string and passes attacker-controlled scriptUrls to injectScript() in packages/altair-core/src/utils/inject.ts, which creates script elements in the page. The intended parent iframe flow places the page in an iframe with sandbox allow-scripts and without allow-same-origin, but direct navigation to a crafted iframe-sandbox URL omits that isolation and executes the supplied script in the origin serving Altair. Exploitation requires a victim to open the crafted URL, and the resulting script can access script-readable storage and make same-origin requests according to the deployment's authentication and cookie controls. This issue is fixed in version 8.5.8."}], "source": {"advisory": "GHSA-752m-7p75-49gf", "discovery": "UNKNOWN"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-110802", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-10T04:16:25.942801Z"}}}], "references": [{"url": "https://github.com/altair-graphql/altair/security/advisories/GHSA-752m-7p75-49gf", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-10T04:18:15.920Z"}}]}}

{"affected": [{"affectedData": [{"product": "altair", "vendor": "altair-graphql", "versions": [{"status": "affected", "version": ">= 7.2.4, < 8.5.8"}]}, {"product": "altair-express-middleware", "vendor": "altair-graphql", "versions": [{"status": "affected", "version": ">= 7.2.4, < 8.5.8"}]}, {"product": "altair-fastify-plugin", "vendor": "altair-graphql", "versions": [{"status": "affected", "version": ">= 7.2.4, < 8.5.8"}]}, {"product": "altair-koa-middleware", "vendor": "altair-graphql", "versions": [{"status": "affected", "version": ">= 7.2.4, < 8.5.8"}]}, {"product": "altair-static", "vendor": "altair-graphql", "versions": [{"status": "affected", "version": ">= 7.2.4, < 8.5.8"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Altair is a GraphQL client for all platforms. From 7.2.4 until 8.5.8, packages/altair-iframe-sandbox/src/main.ts reads plugin_sandbox_opts from the iframe-sandbox query string and passes attacker-controlled scriptUrls to injectScript() in packages/altair-core/src/utils/inject.ts, which creates script elements in the page. The intended parent iframe flow places the page in an iframe with sandbox allow-scripts and without allow-same-origin, but direct navigation to a crafted iframe-sandbox URL omits that isolation and executes the supplied script in the origin serving Altair. Exploitation requires a victim to open the crafted URL, and the resulting script can access script-readable storage and make same-origin requests according to the deployment's authentication and cookie controls. This issue is fixed in version 8.5.8."}], "id": "CVE-2026-110802", "lastModified": "2026-11-12T22:18:51.470", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-110802", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-10T04:16:25.942801Z", "version": "2.0.3"}}]}, "published": "2026-11-05T21:18:35.267", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/altair-graphql/altair/commit/53a19183ce11ca147bb990c355e14ecb1dd7cd3e"}, {"source": "security-advisories@github.com", "url": "https://github.com/altair-graphql/altair/commit/bdf422bdaaaf3186170ba7f22e22c259072133d9"}, {"source": "security-advisories@github.com", "url": "https://github.com/altair-graphql/altair/releases/tag/v8.5.8"}, {"source": "security-advisories@github.com", "url": "https://github.com/altair-graphql/altair/security/advisories/GHSA-752m-7p75-49gf"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/altair-graphql/altair/security/advisories/GHSA-752m-7p75-49gf"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}, {"lang": "en", "value": "CWE-829"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "altair: Altair: Cross-site scripting via crafted iframe sandbox URL", "id": "2567441", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2567441"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.1", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "status": "draft"}, "cwe": "CWE-79", "details": ["A flaw was found in Altair. The application improperly handles script URLs supplied through URL query parameters in its iframe sandbox, allowing external scripts to be injected into the page without proper sandbox isolation. By convincing a victim to navigate to a specially crafted link, a remote attacker can execute arbitrary scripts within the context of the application's origin. This can lead to cross-site scripting (XSS), allowing the attacker to access sensitive stored data or perform unauthorized actions on behalf of the victim."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-110802", "public_date": "2026-11-05T20:41:52Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-110802\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-110802\nhttps://github.com/altair-graphql/altair/commit/53a19183ce11ca147bb990c355e14ecb1dd7cd3e\nhttps://github.com/altair-graphql/altair/commit/bdf422bdaaaf3186170ba7f22e22c259072133d9\nhttps://github.com/altair-graphql/altair/releases/tag/v8.5.8\nhttps://github.com/altair-graphql/altair/security/advisories/GHSA-752m-7p75-49gf"], "statement": "Red Hat has classified this vulnerability as Moderate because exploitation requires user interaction and the impact is confined to the client's web browser session. When a victim is enticed to open an attacker-controlled link targeting the web interface, arbitrary scripts can execute within that origin, potentially exposing browser-stored credentials or issuing requests on behalf of the user. The issue does not permit server-side privilege escalation or compromise of the host infrastructure.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.2.4,8.5.8)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "altair-express-middleware", "source": "cna", "vendor": "altair-graphql"}, "product": "altair-express-middleware", "vendor": "altair-graphql"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.2.4,8.5.8)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "altair-fastify-plugin", "source": "cna", "vendor": "altair-graphql"}, "product": "altair-fastify-plugin", "vendor": "altair-graphql"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.2.4,8.5.8)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "altair-koa-middleware", "source": "cna", "vendor": "altair-graphql"}, "product": "altair-koa-middleware", "vendor": "altair-graphql"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.2.4,8.5.8)"}}], "enrichment": {"confidence": 98.0, "confidence_source": "matching", "scores": [{"score": 98.0, "source": "matching"}]}, "original": {"product": "altair", "source": "cna", "vendor": "altair-graphql"}, "product": "altair", "vendor": "altairgraphql"}], "created": "2026-11-05T22:00:19.150753+00:00", "updated": "2026-11-06T21:13:53.919282+00:00", "vendors": ["altair-graphql", "altair-graphql$PRODUCT$altair-express-middleware", "altair-graphql$PRODUCT$altair-fastify-plugin", "altair-graphql$PRODUCT$altair-koa-middleware", "altairgraphql", "altairgraphql$PRODUCT$altair"], "weaknesses": ["CWE-79", "CWE-829"]}