Altair: DOM-based XSS via attacker-controlled script URLs in the iframe sandbox

Summary Altair 8.5.7 accepts plugin configuration directly from the iframe-sandbox query string. When pluginsandboxopts contains type: "scripts" and an attacker-controlled URL in scriptUrls, the sandbox page creates a classic element and loads the supplied script. In the intended plugin flow, thi...