CVE-2026-110802

Altair is a GraphQL client for all platforms. From 7.2.4 until 8.5.8, packages/altair-iframe-sandbox/src/main.ts reads pluginsandboxopts from the iframe-sandbox query string and passes attacker-controlled scriptUrls to injectScript in packages/altair-core/src/utils/inject.ts, which creates script...