CVE-2026-0824: Cross-Site Scripting Vulnerability in @questdb/web-console
Summary
CVE-2026-0824: QuestDB UI's Web Console is Vulnerable to Cross-Site Scripting. Affects @questdb/web-console versions < 1.1.10. Fixed in 1.1.10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @questdb/web-console package is a component of QuestDB, an open-source time series database designed for high performance and scalability. It provides a web-based user interface that allows users to interact with the database, visualize data, and manage database operations. However, versions up to 1.11.9 of this package are vulnerable to a cross-site scripting (XSS) flaw, which can be exploited by attackers to execute malicious scripts in the context of the user's browser.
Vulnerability Detail
A security flaw has been identified in the Web Console component of the @questdb/web-console package, affecting versions up to 1.11.9. This vulnerability allows attackers to manipulate the web console, leading to cross-site scripting (XSS) attacks. The exploitation of this vulnerability can result in unauthorized actions being performed on behalf of the user, data theft, or other malicious activities. The flaw is categorized under CWE-79, indicating its nature as a cross-site scripting issue, and it can be executed remotely, posing a significant risk to users of the affected versions.
How To Fix
Latest published version: 2.0.5 as of 22 Oct 2026
npm install @questdb/web-console@2.0.5Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.1.10
This is the first release that contains the fix.
npm install @questdb/web-console@1.1.10Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can restrict access to the web console or implement input validation and sanitization on user inputs to mitigate the risk of XSS attacks until the package is updated.
Conclusion
The CVE-2026-0824 vulnerability in the @questdb/web-console package poses a significant risk due to its potential for cross-site scripting attacks. Users are strongly advised to upgrade to the patched version 1.1.10 to mitigate this risk. Additionally, utilizing tools like Vulert can help in monitoring and identifying vulnerabilities in your applications.
See every vulnerability recorded for @questdb/web-console →
FAQ
CVE-2026-0824 is a vulnerability in the @questdb/web-console package that allows for cross-site scripting (XSS) attacks.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which analyzes your package-lock.json for vulnerabilities.
The vulnerability can lead to unauthorized actions, data theft, and other malicious activities performed in the context of the user's session.
Yes, upgrading to version 1.1.10 or later of the @questdb/web-console package will patch the vulnerability.
Vulert monitors and alerts for open-source vulnerabilities in your software using just the package-lock.json file, providing real-time insights without requiring code access.
