PT-2026-2029 · Questdb+1 · Questdb+1

59Lab + 1 · Published 2026-01-10 · Updated 2026-01-10 · CVE-2026-0824

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions questdb ui versions up to 1.11.9

Description A security flaw exists in the Web Console component of questdb ui, potentially leading to cross-site scripting. The issue is remotely exploitable, and an exploit has been publicly released. The vulnerability involves manipulation of an unknown function within the Web Console.

Recommendations Upgrade to version 1.11.10 to address this issue. Upgrade to QuestDB 9.3.0 to address this issue.

Exploit

Fix

XSS

Code Injection

Weakness Enumeration

CWE-79

CWE-94

Related Identifiers

CVE-2026-0824

GHSA-XF94-H87H-G9WR

Affected Products

Questdb

Questdb Ui

References · 16

• 🔥 https://github.com/questdb/ui/pull/519#issue-3790862030 · Exploit
• https://github.com/questdb/questdb/releases/tag/9.3.0 · Patch
• https://github.com/questdb/ui/commit/b42fd9f18476d844ae181a10a249e003dafb823d · Patch
• https://github.com/questdb/ui/pull/518 · Patch
• https://osv.dev/vulnerability/CVE-2026-0824 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-xf94-h87h-g9wr · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-0824 · Security Note
• https://github.com/questdb/ui · Note
• https://github.com/59lab/dbdb/blob/main/There%20is%20a%20cross-site%20scripting(XSS)%20vulnerability%20in%20the%20QuestDB%20database.md · Note
• https://twitter.com/CVEnew/status/2010001933025849646 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2010015192566972839 · Twitter Post
• https://vuldb.com/?ctiid.340357 · Note
• https://vuldb.com/?id.340357 · Note
• https://vuldb.com/?submit.733253 · Note
• https://t.me/CVEtracker/41949 · Telegram Post