CVE-2023-43799

MEDIUM

Altair < 5.2.5 - Remote Code Execution via External URL Handling

Title source: llm

Description

Altair is a GraphQL Client. Prior to version 5.2.5, the Altair GraphQL Client Desktop Application does not sanitize external URLs before passing them to the underlying system. Moreover, Altair GraphQL Client also does not isolate the context of the renderer process. This affects versions of the software running on MacOS, Windows, and Linux. Version 5.2.5 fixes this issue.

References (2)

Core 2

Core References

Vendor Advisory x_refsource_confirm

https://github.com/altair-graphql/altair/security/advisories/GHSA-9m5v-vrf6-fmvm

Release Notes x_refsource_misc

https://github.com/altair-graphql/altair/releases/tag/v5.2.5

Scores

CVSS v3 5.0

EPSS 0.0020

EPSS Percentile 9.9%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

Details

CWE

CWE-20

Status published

Products (1)

altairgraphql/altair < 5.2.5

Published Oct 04, 2023

Tracked Since Feb 18, 2026