Low severity3.5OSV Advisory· Published Jan 10, 2026· Updated Apr 29, 2026
CVE-2026-0824
CVE-2026-0824
Description
A security flaw has been discovered in questdb ui up to 1.11.9. Impacted is an unknown function of the component Web Console. The manipulation results in cross site scripting. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 1.1.10 is recommended to address this issue. The patch is identified as b42fd9f18476d844ae181a10a249e003dafb823d. You should upgrade the affected component. The vendor confirmed early that the fix "is going to be released as a part of QuestDB 9.3.0" as well.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
@questdb/web-consolenpm | < 1.1.10 | 1.1.10 |
Affected products
2Patches
Vulnerability mechanics
References
10- github.com/advisories/GHSA-xf94-h87h-g9wrghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-0824ghsaADVISORY
- github.com/59lab/dbdb/blob/main/There%20is%20a%20cross-site%20scripting(XSS)%20vulnerability%20in%20the%20QuestDB%20database.mdnvdWEB
- github.com/questdb/questdb/releases/tag/9.3.0nvdWEB
- github.com/questdb/ui/commit/b42fd9f18476d844ae181a10a249e003dafb823dnvdWEB
- github.com/questdb/ui/pull/518nvdWEB
- github.com/questdb/ui/pull/519nvdWEB
- vuldb.comnvdWEB
- vuldb.comnvdWEB
- vuldb.comnvdWEB
News mentions
0No linked articles in our index yet.