Skip to content
OpenAdvisories

Package · npm

altair-static

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Feed

  • Medium 6.1
    CVE-2026-110802

    Altair: DOM-based XSS via attacker-controlled script URLs in the iframe sandbox

    Altair is a GraphQL client for all platforms. From 7.2.4 until 8.5.8, packages/altair-iframe-sandbox/src/main.ts reads plugin_sandbox_opts from the iframe-sandbox query string and passes attacker-controlled scriptUrls to injectScript() in packages/altair-core…

    altair-graphql altair altair-express-middleware altair-koa-middleware npm