CVE-2026-110802: Altair: DOM-based XSS via attacker-controlled script URLs in the iframe sandbox
Altair is a GraphQL client for all platforms. From 7.2.4 until 8.5.8, packages/altair-iframe-sandbox/src/main.ts reads pluginsandboxopts from the iframe-sandbox query string and passes attacker-controlled scriptUrls to injectScript() in packages/altair-core/src/utils/inject.ts, which creates script elements in the page. The intended parent iframe flow places the page in an iframe with sandbox allow-scripts and without allow-same-origin, but direct navigation to a crafted iframe-sandbox URL omits that isolation and executes the supplied script in the origin serving Altair. Exploitation requires a victim to open the crafted URL, and the resulting script can access script-readable storage and make same-origin requests according to the deployment's authentication and cookie controls. This issue is fixed in version 8.5.8.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Altairto a version that resolves this vulnerability.Fixed in 8.5.8
Event History
Frequently Asked Questions
Which deployments are exposed?
Altair deployments using affected versions from 7.2.4 up to the fix in 8.5.8 are exposed when the iframe-sandbox page is served and can be directly navigated to. The intended embedded iframe flow uses a sandbox without allow-same-origin, but that isolation does not apply to a directly opened crafted URL.
What does an attacker need to exploit this issue?
An attacker needs to get a victim to open a crafted iframe-sandbox URL. No authentication or other attacker privileges are required, but exploitation requires victim interaction.
What could successful exploitation access?
The injected script executes in the origin serving Altair when the crafted sandbox URL is directly opened. It can access script-readable storage and make same-origin requests, subject to the deployment's authentication and cookie controls.
How can I determine whether I need to remediate?
Check the deployed Altair version and whether it includes the 8.5.8 fix. Also determine whether users can directly reach the iframe-sandbox page, since direct navigation is what bypasses the intended iframe isolation.