{"id":"CVE-2026-110802","kind":"vulnerability","aliases":["CVE-2026-110802"],"related":[],"title":"Altair GraphQL client: crafted URL runs attacker script in origin","description":"Altair is a GraphQL client for all platforms. From 7.2.4 until 8.5.8, packages/altair-iframe-sandbox/src/main.ts reads plugin_sandbox_opts from the iframe-sandbox query string and passes attacker-controlled scriptUrls to injectScript() in packages/altair-core/src/utils/inject.ts, which creates script elements in the page. The intended parent iframe flow places the page in an iframe with sandbox allow-scripts and without allow-same-origin, but direct navigation to a crafted iframe-sandbox URL omits that isolation and executes the supplied script in the origin serving Altair. Exploitation requires a victim to open the crafted URL, and the resulting script can access script-readable storage and make same-origin requests according to the deployment's authentication and cookie controls. This issue is fixed in version 8.5.8.","summary":"Altair is a GraphQL client, and its iframe-sandbox page passes attacker-supplied script URLs into the page when opened directly. A victim who opens a crafted link runs the attacker's script in the origin serving Altair, where it can read script-accessible storage and make same-origin requests.","severity":"medium","cvss":6.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["altair","graphql","other","self-hosted","web"],"not_affected_if":["versions-8.5.8-or-later","versions-before-7.2.4"],"how_to_check":"- Check the installed Altair version in `packages/altair-iframe-sandbox` or the deployed web app's package version.\n- Look for a deployment at versions from `7.2.4` up to but not including `8.5.8`.","fix":"- Altair: move to `8.5.8`.","status":"open","published_at":"2026-11-05T21:18:35+00:00","first_seen_at":"2026-11-05T21:40:44+00:00","triaged_at":"2026-11-05T21:41:16+00:00","updated_at":"2026-11-05T21:41:16+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-05T21:41:16Z","model":"claude-haiku-5-5","output":{"fix":"- Altair: move to `8.5.8`.","reach":"internet","title":"Altair GraphQL client: crafted URL runs attacker script in origin","impact":"medium","summary":"Altair is a GraphQL client, and its iframe-sandbox page passes attacker-supplied script URLs into the page when opened directly. A victim who opens a crafted link runs the attacker's script in the origin serving Altair, where it can read script-accessible storage and make same-origin requests.","audience":"businesses","category":"other","nicknames":[],"who_cares":["altair","graphql","self-hosted","web"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"Attacker script runs in the Altair origin and reads storage.","analyst_note":"","how_to_check":"- Check the installed Altair version in `packages/altair-iframe-sandbox` or the deployed web app's package version.\n- Look for a deployment at versions from `7.2.4` up to but not including `8.5.8`.","plain_action":"","needs_analyst":false,"not_affected_if":["versions-before-7.2.4","versions-8.5.8-or-later"],"who_is_affected":"Teams that host Altair's web client on their own origin, where a victim can be sent a crafted iframe-sandbox URL. Desktop or fully offline installs that never serve this origin are unlikely to be exposed; the sources do not say more.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000707,"input_tokens":4448,"output_tokens":525,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-110802':13A,16A '-2026':12A,15A '7.2.4':87C '8.5.8':89C,204C 'access':70B,178C 'accord':189C 'allow':133C,138C 'allow-same-origin':137C 'allow-script':132C 'altair':1A,17B,24B,63B,78C,163C 'attack':7A,37B,56B,105C 'attacker-control':104C 'attacker-suppli':36B 'authent':194C 'client':3A,28B,82C 'control':106C,197C 'cooki':196C 'craft':4A,52B,146C,171C 'creat':113C 'cve':11A,14A 'deploy':192C 'direct':46B,142C 'element':115C 'execut':155C 'exploit':164C 'fix':201C 'flow':123C 'graphql':2A,18B,27B,81C 'host':22B 'ifram':32B,98C,122C,129C,148C 'iframe-sandbox':31B,97C,147C 'injectscript':109C 'intend':120C 'isol':153C 'issu':199C 'link':53B 'make':73B,184C 'navig':143C 'omit':151C 'open':45B,50B,169C 'opt':94C 'origin':10A,61B,76B,140C,161C,187C 'packages/altair-core/src/utils/inject.ts':111C 'packages/altair-iframe-sandbox/src/main.ts':90C 'page':34B,43B,118C,126C 'parent':121C 'pass':35B,103C 'place':124C 'platform':85C 'plugin':92C 'queri':100C 'read':67B,91C 'readabl':181C 'request':77B,188C 'requir':165C 'result':175C 'run':6A,54B 'same-origin':74B,185C 'sandbox':33B,93C,99C,131C,149C 'script':8A,39B,58B,69B,114C,134C,158C,176C,180C 'script-access':68B 'script-read':179C 'scripturl':107C 'self':21B 'self-host':20B 'serv':62B,162C 'storag':71B,182C 'string':101C 'suppli':38B,157C 'url':5A,40B,150C,172C 'version':203C 'victim':48B,167C 'web':23B 'without':136C","nicknames":[],"mitigations":[],"who_affected":"Teams that host Altair's web client on their own origin, where a victim can be sent a crafted iframe-sandbox URL. Desktop or fully offline installs that never serve this origin are unlikely to be exposed; the sources do not say more.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["altair","graphql","medium","other","selfhosted","web"],"campaign_type":null,"first_public_at":"2026-10-16T20:04:17+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110802","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110802","severity":null,"published_at":"2026-11-05T21:18:35+00:00","modified_at":"2026-11-05T21:18:35+00:00","first_seen_at":"2026-11-05T21:40:44+00:00","fetched_at":"2026-11-05T21:40:44+00:00","note":null}],"documents":[{"id":80322,"url":"https://github.com/altair-graphql/altair/commit/53a19183ce11ca147bb990c355e14ecb1dd7cd3e","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":80323,"url":"https://github.com/altair-graphql/altair/commit/bdf422bdaaaf3186170ba7f22e22c259072133d9","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":80324,"url":"https://github.com/altair-graphql/altair/releases/tag/v8.5.8","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":80325,"url":"https://github.com/altair-graphql/altair/security/advisories/GHSA-752m-7p75-49gf","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-16T20:04:17+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}