questdb ui Console Web cross site scripting

The XSS vulnerability in QuestDB UI allows an attacker to inject arbitrary JavaScript code into the Web Console. This code can then be executed in the context of a user's browser, potentially granting the attacker access to sensitive information such as session cookies or authentication tokens. With these credentials, an attacker could impersonate a legitimate user and perform actions on their behalf, including accessing and modifying data within the QuestDB database. The public availability of an exploit significantly increases the risk of exploitation, as attackers can readily leverage existing tools and techniques to target vulnerable systems.

Organizations utilizing QuestDB UI in production environments, particularly those running versions 1.11.0 through 1.11.9, are at risk. Shared hosting environments where multiple users share the same QuestDB instance are especially vulnerable, as an attacker could potentially compromise the entire system through a single user's session.

• generic web: Use curl to test for XSS vulnerabilities in the Web Console. Try injecting <script>alert(1)</script> into various input fields and observe the response.

curl -X POST -d '<script>alert(1)</script>' <web_console_url>

• generic web: Examine access and error logs for suspicious patterns related to script injection attempts. • generic web: Review response headers for any unusual content or modifications that might indicate XSS activity.

1. 2026-01-10Disclosure

   disclosure

2. 2026-01-10PoC

   poc

3. 2026-01-10Patch

   patch

1. Reservado2026-01-09
2. Publicada2026-01-10
3. Modificada2026-02-23
4. EPSS atualizado2026-03-23

The primary mitigation for CVE-2026-0824 is to upgrade QuestDB UI to version 1.1.10 or later. The vendor has confirmed that this fix will also be included in QuestDB 9.3.0. If an immediate upgrade is not feasible, consider implementing temporary workarounds such as strict input validation and output encoding within the Web Console to prevent the injection of malicious scripts. Web Application Firewalls (WAFs) configured to detect and block XSS payloads can also provide an additional layer of protection. After upgrading, confirm the fix by attempting to inject a simple XSS payload (e.g., <script>alert(1)</script>) into the Web Console and verifying that it is not executed.