npm: Altair: DOM-based XSS via attacker-controlled script URLs in the iframe sandbox

npm: Altair: DOM-based XSS via attacker-controlled script URLs in the iframe sandbox vulnerability discovered by ? in WordPress npm altair-static versions = 7.2.4, 8.5.8...

@cloudcommerce/storefront (>=0.10.0, <=0.11.0), @gspenst/next (>=0.1.0, <=0.1.2) +10 more potentially affected by CVE-2026-110802 via altair-static (>=7.3.6, <=8.5.8-alpha.d658484.0)

altair-static NPM version =7.3.6, =0.10.0, =0.1.0, =0.1.0, =0.0.0-20240703042008, =0.0.2, =0.0.3, =7.0.0, =7.0.0, =7.0.0, =7.0.0, =0.1.1, =0.1.3 - ramidus 1.2.1 Source cves: CVE-2026-110802 Source advisory: MEND:CVE-2026-110802...