{"action":"Upgrade @questdb/web-console to 1.1.10 or later.","affected":[{"fixed":"1.1.10","introduced":"0"}],"component":"@questdb/web-console","cve_ids":["CVE-2026-0824"],"ecosystem":"npm","epss":0.00289,"exploited":false,"fixed_versions":["1.1.10"],"ghsa_id":"GHSA-xf94-h87h-g9wr","id":"tcs_01M5KGHSM98QPVFPASPH0EETTP","modified_at":"2026-02-03T03:01:09.818690Z","published_at":"2026-01-10T15:31:22Z","references":["https://osv.dev/vulnerability/GHSA-xf94-h87h-g9wr","https://nvd.nist.gov/vuln/detail/CVE-2026-0824","https://github.com/questdb/ui/pull/518","https://github.com/questdb/ui/pull/519#issue-3790862030","https://github.com/questdb/ui/commit/b42fd9f18476d844ae181a10a249e003dafb823d","https://github.com/59lab/dbdb/blob/main/There%20is%20a%20cross-site%20scripting(XSS)%20vulnerability%20in%20the%20QuestDB%20database.md","https://github.com/questdb/questdb/releases/tag/9.3.0","https://github.com/questdb/ui","https://vuldb.com/?ctiid.340357","https://vuldb.com/?id.340357","https://vuldb.com/?submit.733253"],"severity":{"label":"low","score":3.5},"sources":[{"source":"osv","source_id":"GHSA-xf94-h87h-g9wr","url":"https://osv.dev/vulnerability/GHSA-xf94-h87h-g9wr"}],"summary":"QuestDB UI's Web Console is Vulnerable to Cross-Site Scripting"}