Executive brief
QuestDB's Web Console is a browser-based interface for database management and querying. An attacker with authenticated access could inject malicious scripts that execute in the context of other users' browser sessions, potentially allowing credential theft, session hijacking, or malicious actions performed on behalf of the victim.
Technical details
A cross-site scripting (CWE-79) vulnerability exists in QuestDB UI's Web Console component, affecting versions up to 1.1.9. The vulnerability allows an authenticated attacker to inject arbitrary JavaScript code through an unspecified function in the Web Console. The attack requires network access, prior authentication (login), and user interaction (victim must visit the malicious payload). An attacker can deface pages or steal sensitive information from authenticated sessions. The fix is available in version 1.1.10 (commit b42fd9f18476d844ae181a10a249e003dafb823d) and included in QuestDB 9.3.0.
Affected products
- QuestDB Web Console up to 1.1.9
Timeline
- 2026-01-10: disclosed
- 2026-01-08: patched: Fix released in version 1.1.10 and QuestDB 9.3.0
- 2026-02-03: other: Advisory modified/updated