CVE-2026-0824: XSS in QuestDB UI

The XSS vulnerability in QuestDB UI allows an attacker to inject arbitrary JavaScript code into the Web Console. This code can then be executed in the context of a user's browser, potentially granting the attacker access to sensitive information such as session cookies or authentication tokens. With these credentials, an attacker could impersonate a legitimate user and perform actions on their behalf, including accessing and modifying data within the QuestDB database. The public availability of an exploit significantly increases the risk of exploitation, as attackers can readily leverage existing tools and techniques to target vulnerable systems.

1. Reserved2026-01-09
2. Published2026-01-10
3. Modified2026-02-23
4. EPSS updated2026-03-23

The primary mitigation for CVE-2026-0824 is to upgrade QuestDB UI to version 1.1.10 or later. The vendor has confirmed that this fix will also be included in QuestDB 9.3.0. If an immediate upgrade is not feasible, consider implementing temporary workarounds such as strict input validation and output encoding within the Web Console to prevent the injection of malicious scripts. Web Application Firewalls (WAFs) configured to detect and block XSS payloads can also provide an additional layer of protection. After upgrading, confirm the fix by attempting to inject a simple XSS payload (e.g., <script>alert(1)</script>) into the Web Console and verifying that it is not executed.