altair-static vulnerabilities

CVEs whose affected-version data names the altair-static package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-110802Medium· 6.1

yesterday

Altair: DOM-based XSS via attacker-controlled script URLs in the iframe sandbox

Altair is a GraphQL client for all platforms. From 7.2.4 until 8.5.8, packages/altair-iframe-sandbox/src/main.ts reads plugin_sandbox_opts from the iframe-sandbox query string and passes attacker-controlled scriptUrls to injectScript() i…

▾ Sunlitaltair-graphql · altairvia CVEORG