Altair: DOM-based XSS via attacker-controlled script URLs in the iframe sandbox
Altair 8.5.7 accepts plugin configuration directly from the iframe-sandbox query string. When plugin_sandbox_opts contains type: "scripts" and an attacker-controlled URL in scriptUrls, the sandbox page creates a classic <script src="…"> element and loads the supplied script. In the intended plugin flow, this page runs inside an <iframe sandbox="allow-scripts"> without allow-same-origin, giving plugin code an opaque origin. However, if a victim opens the crafted sandbox URL directly, that iframe isolation is …