CVE-2026-110802

The Altair GraphQL client (versions 7.2.4 through 8.5.8 ) is vulnerable to a DOM-based XSS due to improper handling of the plugin_sandbox_opts query string parameter in packages/altair-iframe-sandbox/src/main.ts. An attacker can provide malicious scriptUrls which are passed to injectScript() in p...