CVE-2023-43799

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Altair is a GraphQL Client. Prior to version 5.2.5, the Altair GraphQL Client Desktop Application does not sanitize external URLs before passing them to the underlying system. Moreover, Altair GraphQL Client also does not isolate the context of the renderer process. This affects versions of the software running on MacOS, Windows, and Linux. Version 5.2.5 fixes this issue.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
altair-graphql	altair	< 5.2.5
altairgraphql	altair	< 5.2.5

References

https://github.com/altair-graphql/altair/releases/tag/v5.2.5Release Notes
https://github.com/altair-graphql/altair/security/advisories/GHSA-9m5v-vrf6-fmvmVendor Advisory
https://github.com/altair-graphql/altair/releases/tag/v5.2.5Release Notes
https://github.com/altair-graphql/altair/security/advisories/GHSA-9m5v-vrf6-fmvmVendor Advisory

Timeline

Published: Oct 4, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-43806.3A logic flaw exists in Ansible Automation platform. Whenever a private project is created with incorrect credentials, they are logged in pla CVE-2023-438007.8Arduino Create Agent is a package to help manage Arduino development. The vulnerability affects the endpoint `/v2/pkgs/tools/installed`. A u CVE-2023-438017.1Arduino Create Agent is a package to help manage Arduino development. This vulnerability affects the endpoint `/v2/pkgs/tools/installed` and CVE-2023-438027.8Arduino Create Agent is a package to help manage Arduino development. This vulnerability affects the endpoint `/upload` which handles reques CVE-2023-438037.1Arduino Create Agent is a package to help manage Arduino development. This vulnerability affects the endpoint `/v2/pkgs/tools/installed` and CVE-2023-438048.1urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the `Cookie` HTTP header special or provide any helpers for CVE-2023-438057.5Nexkey is a fork of Misskey, an open source, decentralized social media platform. Prior to version 12.121.9, incomplete URL validation can a CVE-2023-438097.5Soft Serve is a self-hostable Git server for the command line. Prior to version 0.6.2, a security vulnerability in Soft Serve could allow an CVE-2023-43814.3Unverified Password Change in GitHub repository instantsoft/icms2 prior to 2.16.1-git.CVE-2023-438107.5OpenTelemetry, also known as OTel for short, is a vendor-neutral open-source Observability framework for instrumenting, generating, collecti CVE-2023-438138.8GLPI is a free asset and IT management software package. Starting in version 10.0.0 and prior to version 10.0.11, the saved search feature c CVE-2023-438143.7Discourse is an open source platform for community discussion. Attackers with details specific to a poll in a topic can use the `/polls/grou