{"metadata": {"vulnerability": "CVE-2026-110802", "count": 7, "kinds": {"milestone": 3, "sighting": 1, "kev": 0, "other": 3}}, "data": [{"timestamp": "2026-10-14T17:40:14.920Z", "date_only": false, "value": "2026-10-14T17:40:14.920Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-110802", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-11-05T20:41:52.499Z", "date_only": false, "value": "2026-11-05T20:41:52.499Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-110802", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-05T20:41:52.499Z", "date_only": false, "value": "2026-11-05T20:41:52.499Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-110802", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-11-05T20:41:52.499Z", "date_only": false, "value": "2026-11-05T20:41:52.499Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-110802", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-05T20:58:54.162Z", "date_only": false, "value": "2026-11-05T20:58:54.162026Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117565838697531879", "record": "CVE-2026-110802", "field": "creation_timestamp", "uuid": "a407804e-6ede-4050-8438-53381533a139", "content": "CVE-2026-110802 Altair: DOM-based XSS via attacker-controlled script URLs in the iframe sandbox Altair is a GraphQL client for all platforms. From 7.2.4 until 8.5.8, packages/altair-iframe-sandbox/src/main.ts reads plugin_sandbox_opts from the iframe-sandbox query string and passes attacker-controlled scriptUrls to injectScript() in packages/altair-core/src/utils/inject.ts, which creates script elements in the page. The intended parent iframe flow places the page in an iframe with sandbox allow-scripts and without allow-same-origin, but direct navigation to a crafted iframe-sandbox URL omits that isolation and executes the supplied script in the origin serving Altair. Exploitation requires a victim to open the crafted URL, and the resulting script can access script-readable storage and make same-origin requests according to the deployment's authentication and cookie controls. This issue is fixed in version 8.5.8.\nhttps://www.cve.org/CVERecord?id=CVE-2026-110802https://github.com/altair-graphql/altair/security/advisories/GHSA-752m-7p75-49gfhttps://github.com/altair-graphql/altair/commit/53a19183ce11ca147bb990c355e14ecb1dd7cd3ehttps://github.com/altair-graphql/altair/commit/bdf422bdaaaf3186170ba7f22e22c259072133d9https://github.com/altair-graphql/altair/releases/tag/v8.5.8#altair-graphql #altair #altair-express-middleware #altair-fastify-plugin #altair-koa-middleware #altair-static#CVE_2026_110802#bot", "url": "https://infosec.exchange/users/cve/statuses/117565838697531879"}, {"timestamp": "2026-11-05T21:18:35.267Z", "date_only": false, "value": "2026-11-05T21:18:35.267", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-110802", "record": "FKIE_CVE-2026-110802", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-05T21:18:35.267Z", "date_only": false, "value": "2026-11-05T21:18:35.267", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-110802", "record": "FKIE_CVE-2026-110802", "field": "lastModified", "linked_record": true}], "metrics": {"as_of": "2026-11-08T14:59:56.069Z", "anchors": {"origin": {"timestamp": "2026-11-05T20:41:52.499Z", "date_only": false, "value": "2026-11-05T20:41:52.499Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-110802", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-11-05T20:41:52.499Z", "date_only": false, "value": "2026-11-05T20:41:52.499Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-110802", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 238683.57028, "hours": 66.30099174444445, "days": 2.7625413226851854, "min_seconds": 238683.57028, "max_seconds": 238683.57028, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-11-05T20:41:52.499Z", "date_only": false, "value": "2026-11-05T20:41:52.499Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-110802", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-08T14:59:56.069Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}