Skip to content
OpenAdvisories

Vendor

altair-graphql

3 known vulnerabilities.

Products

altair 3 altair-express-middleware 1 altair-fastify-plugin 1 altair-koa-middleware 1 altair-static 1
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 6.1
    CVE-2026-110802

    Altair: DOM-based XSS via attacker-controlled script URLs in the iframe sandbox

    Altair is a GraphQL client for all platforms. From 7.2.4 until 8.5.8, packages/altair-iframe-sandbox/src/main.ts reads plugin_sandbox_opts from the iframe-sandbox query string and passes attacker-controlled scriptUrls to injectScript() in packages/altair-core…

    altair-graphql altair altair-express-middleware altair-koa-middleware npm
  • Medium 6.8
    CVE-2024-54147

    Altair GraphQL Client's desktop app does not validate HTTPS certificates

    Altair is a GraphQL client for all platforms. Prior to version 8.0.5, Altair GraphQL Client's desktop app does not validate HTTPS certificates allowing a man-in-the-middle to intercept all requests. Any Altair users on untrusted networks (eg. public wifi, mal…

    altair-graphql altair
  • Medium 5.0
    CVE-2023-43799

    The Altair Desktop Client Does Not Sanitize External URLs before passing them to the underlying system

    Altair is a GraphQL Client. Prior to version 5.2.5, the Altair GraphQL Client Desktop Application does not sanitize external URLs before passing them to the underlying system. Moreover, Altair GraphQL Client also does not isolate the context of the renderer p…

    altair-graphql altair