CVE-2026-110802

Altair is a GraphQL client for all platforms. From 7.2.4 until 8.5.8, packages/altair-iframe-sandbox/src/main.ts reads plugin_sandbox_opts from the iframe-sandbox query string and passes attacker-controlled scriptUrls to injectScript() in packages/altair-core/src/utils/inject.ts, which creates script elements in the page. The intended parent iframe flow places the page in an iframe with sandbox allow-scripts and without allow-same-origin, but direct navigation to a crafted iframe-sandbox URL omits that isolation and executes the supplied script in the origin serving Altair. Exploitation requires a victim to open the crafted URL, and the resulting script can access script-readable storage and make same-origin requests according to the deployment's authentication and cookie controls. This issue is fixed in version 8.5.8.

• CWE-79
• CWE-829

• https://github.com/altair-graphql/altair/commit/53a19183ce11ca147bb990c355e14ecb1dd7cd3e
• https://github.com/altair-graphql/altair/commit/bdf422bdaaaf3186170ba7f22e22c259072133d9
• https://github.com/altair-graphql/altair/releases/tag/v8.5.8
• https://github.com/altair-graphql/altair/security/advisories/GHSA-752m-7p75-49gf

Published

Nov 5, 2026

Last Modified

Nov 5, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-110777A flaw was found in evolution-data-server. Calendar events c…5.7
• CVE-2026-11078Inappropriate implementation in FileSystem in Google Chrome …6.5
• CVE-2026-11079Insufficient validation of untrusted input in Codecs in Goog…8.8
• CVE-2026-110799Vvveb is a powerful and easy to use CMS with page builder to…9.8
• CVE-2026-1108A security vulnerability has been detected in cijliu librtsp…7.8
• CVE-2026-11080Use after free in WebView in Google Chrome on Android prior …8.8
• CVE-2026-110803VaadinService.requestEnd() in Vaadin Framework 8 locks the s…8.7
• CVE-2026-110804Improperly controlled modification of JIT elevation settings…4.3
• CVE-2026-110805Server-side request forgery in PingOne groups endpoint in De…2.6
• CVE-2026-110806Incorrect authorization in add-on properties in Devolutions …6.5
• CVE-2026-110807A weakness has been identified in sgl-project SGLang up to 0…4.3
• CVE-2026-110808The Essential Addons for Elementor WordPress plugin before …4.2