CVE-2026-0824: 
JavaScript vulnerability analysis and mitigation

CVE-2026-0824 is a Cross-Site Scripting (XSS) vulnerability in the QuestDB Web Console UI component, affecting versions up to and including 1.11.9. The flaw was discovered on January 5, 2026, by researcher 59LAB, and publicly disclosed on January 10, 2026. It allows authenticated remote attackers to inject and execute malicious scripts via the Web Console's query result rendering. The vulnerability carries a CVSS v3.1 base score of 3.5 (Low) and a CVSS v4.0 base score of 5.1 (Medium), assigned by VulDB (VulDB, Feedly).

The root cause is improper neutralization of input during web page generation (CWE-79), compounded by improper control of code generation (CWE-94). The Web Console rendered SQL query results and column metadata using innerHTML assignments without sanitizing user-controlled data, allowing HTML and JavaScript to be injected directly into the DOM. The fix (commit b42fd9f) replaced innerHTML with textContent for cell and header rendering, and introduced a dedicated escapeHtml utility for contexts where HTML output is required (e.g., chart axis pickers). A publicly disclosed proof-of-concept demonstrates exploitation via a crafted SQL query: select '<script>alert(1)</script>', which causes the script to execute in the browser of any user viewing the query results (59lab PoC, Fix Commit).

Successful exploitation allows an authenticated attacker to execute arbitrary JavaScript in the browser context of other users viewing the QuestDB Web Console, enabling session token theft, credential harvesting, UI manipulation, and potential account takeover. The vulnerability has no direct impact on confidentiality or availability of the database server itself, but integrity of the web interface is compromised. Because QuestDB is a time-series database often used in operational and IoT environments, session hijacking could facilitate unauthorized data access or manipulation (VulDB, Feedly).

A public proof-of-concept exploit has been released by researcher 59LAB and is available on GitHub, demonstrating exploitation via a simple SQL query submitted through the Web Console (59lab PoC). Exploitation requires low privileges (authenticated access) and passive user interaction (another user must view the injected results). The EPSS score is approximately 0.033%, indicating low automated exploitation probability. There is no evidence of in-the-wild exploitation or inclusion in the CISA KEV catalog at this time. The CVSSv4.0 exploit maturity is rated as Proof-of-Concept (Feedly).

1. Authenticate to QuestDB Web Console: Obtain valid credentials for the QuestDB Web Console (default port 9000). Low-privilege user access is sufficient.
2. Craft a malicious SQL query: Compose a SELECT statement that returns an XSS payload as a string value, for example: select '<script>alert(document.cookie)</script>' or a more sophisticated payload using <img src=x onerror=...>.
3. Execute the query: Submit the crafted query via the Web Console's SQL editor and run it. The result is stored or displayed in the query results grid.
4. Trigger victim execution: When another authenticated user views the same Web Console session or shared query results, the injected payload is rendered via innerHTML (in unpatched versions), causing the script to execute in their browser context.
5. Harvest session data or perform actions: The executed script can exfiltrate session cookies, perform actions on behalf of the victim, or redirect the user to an attacker-controlled page (59lab PoC, Fix Commit).

• Network: Unexpected outbound HTTP requests from the QuestDB Web Console browser session to external or attacker-controlled domains; unusual POST requests to QuestDB's /exec endpoint containing HTML or JavaScript-encoded payloads in query strings.
• Logs: QuestDB query logs showing SQL statements containing <script>, onerror=, javascript:, data:, or other HTML/JS injection patterns submitted by authenticated users.
• Browser/Application: Unexpected JavaScript alerts, redirects, or network requests originating from the QuestDB Web Console (port 9000) in browser developer tools; anomalous DOM modifications in the query results grid.
• File System: No direct file system artifacts expected for this client-side XSS; however, web server access logs may show repeated queries with encoded HTML entities from a single authenticated user account.

Upgrade the QuestDB UI component to version 1.1.10 or later, which replaces unsafe innerHTML assignments with textContent and introduces proper HTML escaping (patch commit b42fd9f) (Fix Commit, Release PR). The fix is also included in QuestDB server release 9.3.0, as confirmed by the vendor (QuestDB 9.3.0). As a workaround prior to patching, restrict Web Console access to trusted users only, enforce a strict Content Security Policy (CSP) disallowing unsafe-inline and data: URIs, and avoid exposing the Web Console (port 9000) to untrusted networks.

The vulnerability was reported by researcher 59LAB (59lab@mchz.com.cn) who published a detailed analysis and PoC on GitHub (59lab PoC). The QuestDB development team responded promptly, merging the fix within days of discovery (January 8, 2026) and confirming the patch would be included in QuestDB 9.3.0 (Fix PR). Coverage has been limited to vulnerability tracking platforms such as VulDB, Vulners, and CIRCL, with no significant broader media or social media discussion noted.