CVE-2026-110802

Name of the Vulnerable Software and Affected Versions Altair versions 7.2.4 through 8.5.7

Description In the packages/altair-iframe-sandbox/src/main.ts file, the application reads plugin sandbox opts from the iframe-sandbox query string and passes attacker-controlled scriptUrls to the injectScript() function in packages/altair-core/src/utils/inject.ts, which creates script elements in the page. While the intended flow uses an iframe with sandbox allow-scripts and without allow-same-origin, direct navigation to a crafted iframe-sandbox URL bypasses this isolation. This allows the execution of supplied scripts in the origin serving Altair, enabling access to script-readable storage and the ability to make same-origin requests based on the deployment's authentication and cookie controls.

Recommendations Update to version 8.5.8.