No access to your tenant or devices. Every item links to its source. What this means
Historical advisory recorded 10 Nov 2026 06:02:11 UTC. Read the latest advisory.
Altair is a GraphQL client for all platforms. From 7.2.4 until 8.5.8, packages/altair-iframe-sandbox/src/main.ts reads plugin_sandbox_opts from the iframe-sandbox query string and passes attacker-controlled scriptUrls to injectScript() in packages/altair-core/src/utils/inject.ts, which creates script elements in the page. The intended parent iframe flow places the page in an iframe with sandbox allow-scripts and without allow-same-origin, but direct navigation to a crafted iframe-sandbox URL omits that isolation and executes the supplied script in the origin serving Altair. Exploitation requires a victim to open the crafted URL, and the resulting script can access script-readable storage and make same-origin requests according to the deployment's authentication and cookie controls. This issue is fixed in version 8.5.8.
Read the publisher's advisoryVendor product
Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "altair-graphql",
"product": "altair",
"versions": [
{
"version": ">= 7.2.4, < 8.5.8",
"status": "affected"
}
]
}Vendor product
Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "altair-graphql",
"product": "altair-express-middleware",
"versions": [
{
"version": ">= 7.2.4, < 8.5.8",
"status": "affected"
}
]
}Vendor product
Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "altair-graphql",
"product": "altair-fastify-plugin",
"versions": [
{
"version": ">= 7.2.4, < 8.5.8",
"status": "affected"
}
]
}Vendor product
Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "altair-graphql",
"product": "altair-koa-middleware",
"versions": [
{
"version": ">= 7.2.4, < 8.5.8",
"status": "affected"
}
]
}Vendor product
Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "altair-graphql",
"product": "altair-static",
"versions": [
{
"version": ">= 7.2.4, < 8.5.8",
"status": "affected"
}
]
}Original source record · Cite this exact observation · Complete original publisher JSON