Mittel 6.1Linux-Server
CVE-2026-110802
altair: Altair: Cross-site scripting via crafted iframe sandbox URL
altair
### Summary Altair `8.5.7` accepts plugin configuration directly from the `iframe-sandbox` query string. When `plugin_sandbox_opts` contains `type: "scripts"` and an attacker-controlled URL in `scriptUrls`, the sandbox page creates a classic ` ` element and loads the supplied script. In the intended plugin flow, this page runs inside an ` ` without `allow-same-origin`, giving plugin code an opaque origin. However, if a victim opens the crafted sandbox URL directly, that…
5. Nov 2026
Original bei Red Hat öffnen