5.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-0824

CVE-2026-0824: questdb ui Web Console cross site scripting

A security flaw has been discovered in questdb ui up to 1.11.9. Impacted is an unknown function of the component Web Console. The manipulation results in cross site scripting. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 1.1.10 is recommended to address this issue. The patch is identified as b42fd9f18476d844ae181a10a249e003dafb823d. You should upgrade the affected component. The vendor confirmed early that the fix "is going to be released as a part of QuestDB 9.3.0" as well.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-0824

CVE-2026-0824:

5.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@questdb/web-console	npm	< 1.1.10	1.1.10

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The security vulnerability is a classic Cross-Site Scripting (XSS) issue within the QuestDB Web Console. The root cause is the improper handling of data returned from database queries, specifically column names and cell data, before rendering it in the user interface. The analysis of the patch b42fd9f18476d844ae181a10a249e003dafb823d reveals two primary vulnerable areas:

Data Grid Rendering: In src/js/console/grid.js, the grid function was responsible for displaying query results. It used the innerHTML property to set the content of table headers and cells. This allowed any HTML tags within the column names (via aliases) or the data itself to be parsed and executed by the browser. The fix was to switch from innerHTML to textContent, which treats the input as plain text and prevents HTML interpretation.
Visualization Configuration: In src/js/console/quick-vis.ts, the quickVis function populates dropdowns for chart axis selection with column names from the query. These names were not sanitized. An attacker could provide a malicious column alias in a query, and the script within it would execute when the visualization panel was rendered. The fix involves explicitly calling a new escapeHtml utility on the column names before they are used in the UI.

In both cases, the vulnerability could be triggered by a user executing a specially crafted SQL query that returns results with malicious content in column names or data, leading to arbitrary JavaScript execution in the context of the user's browser session.

Vulnerable functions

grid

src/js/console/grid.js

The `grid` function was vulnerable to XSS because it used `innerHTML` to render column names and types directly from the query results. An attacker could craft a query with a malicious column alias (e.g., `SELECT 1 as \"<img src=x onerror=alert(1)>\"`) which would then be executed by the browser when the result grid was rendered. The patch remediates this by replacing all instances of `innerHTML` with `textContent`, which does not parse the content as HTML, thereby preventing script execution.

quickVis

src/js/console/quick-vis.ts

The `quickVis` function, used for creating charts, was vulnerable to XSS. It took column names from the query result and used them directly as the `text` property for the x- and y-axis picker UI components. A malicious column name containing HTML and JavaScript would be rendered unescaped. The patch fixes this by sanitizing the column name using a newly introduced `escapeHtml` function before it is passed to the UI component.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.