Cross-Site Scripting Vulnerability in Altair GraphQL Client
CVE-2026-110802
What is CVE-2026-110802?
The Altair GraphQL Client contains a vulnerability that allows attackers to exploit the iframe sandbox query string to inject malicious scripts. This occurs due to the mishandling of user input in the versions 7.2.4 through 8.5.8, leading to unfiltered scriptUrls being executed on the client side. Users navigating to a crafted URL inadvertently allow execution of the injected script, potentially exposing sensitive data through script-readable storage and enabling same-origin requests based on current authentication and cookie settings. This issue has been addressed in version 8.5.8, and users are advised to update to avoid potential exploitation.
Affected Version(s)
altair >= 7.2.4, < 8.5.8
altair-express-middleware >= 7.2.4, < 8.5.8
altair-fastify-plugin >= 7.2.4, < 8.5.8