questdb ui Web Console cross site scripting
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Cross-site scripting, Code execution
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79 and CWE-94.
Summary
A security flaw has been discovered in questdb ui up to 1.11.9. Impacted is an unknown function of the component Web Console. The manipulation results in cross site scripting. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 1.1.10 is recommended to address this issue. The patch is identified as b42fd9f18476d844ae181a10a249e003dafb823d. You should upgrade the affected component. The vendor confirmed early that the fix "is going to be released as a part of QuestDB 9.3.0" as well.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| questdb | ui | 1.11.0; 1.11.1; 1.11.2; 1.11.3; 1.11.4; 1.11.5; 1.11.6; 1.11.7; 1.11.8; 1.11.9 | 1.1.10 | Patch available | CNA |
| — | @questdb/web-console (npm) | before 1.1.10 | 1.1.10 | Patch available | GHSA-xf94-h87h-g9wr |
- ui Vendorquestdb Affected 1.11.0; 1.11.1; 1.11.2; 1.11.3; 1.11.4; 1.11.5; 1.11.6; 1.11.7; 1.11.8; 1.11.9 Fixed in 1.1.10 Patch available CNA
- @questdb/web-console (npm) Vendor— Affected before 1.1.10 Fixed in 1.1.10 Patch available GHSA-xf94-h87h-g9wr
Remediation
- Fix · CNA ui (questdb) Fixed in 1.1.10
- Fix · GHSA-xf94-h87h-g9wr @questdb/web-console (npm) Fixed in 1.1.10 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
Not affected: 2 products
- Red Hat JBoss Enterprise Application Platform 8
- Red Hat JBoss Enterprise Application Platform Expansion Pack
Timeline
- 2026-10-02 Threatist record created from CVE-2026-0824
- 2026-10-03 Alias added: GHSA-xf94-h87h-g9wr
References
Patch 3
Sources
- CVE-2026-0824 · CVE Program
- CVE-2026-0824 · NVD
- FIRST EPSS
- GHSA-xf94-h87h-g9wr · GitHub Advisory Database · CC BY 4.0
- CVE-2026-0824 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences