Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

altair-static

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 6.1npmAmendedPublished

    Altair: DOM-based XSS via attacker-controlled script URLs in the iframe sandbox

    CVE-2026-110802 · GHSA-752m-7p75-49gf

    Affected
    • npm altair-static >= 7.2.4, < 8.5.8
    Fixed in
    8.5.8· Vendor fix available
    Issue
    Altair `8.5.7` accepts plugin configuration directly from the `iframe-sandbox` query string. When `plugin_sandbox_opts` contains `type: "scripts"` and an attacker-controlled URL in `scriptUrls`, the sandbox page creates a classic ` ` element and loads the supplied script. In the intended plugin flow, this page runs inside an ` ` without `allow-same-origin`, giving plugin code an opaque origin. However, if a victim opens the crafted sandbox URL directly, that iframe isolation is absent and the attacker-controlled script executes in the origin serving Altair, resulting in DOM-based cross-site scripting (XSS) / arbitrary JavaScript execution in the Altair hosting origin. Exploitation requires the victim to open a crafted URL. Details The sandbox reads its configuration directly from `window.location.search`. In `packages/altair-iframe-sandbox/src/main.ts`: ``` const searchParams = new URLSearchParams(window.location.search); const sandboxType =…

    Recommended action: Upgrade to 8.5.8 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.com (1)osv.dev (2)Source checked Evidence →