A cross‑site scripting vulnerability exists in the QuestDB UI Web Console component, affecting all releases up to version 1.11.9. The flaw allows an attacker to inject malicious scripts into the console interface, enabling the execution of arbitrary client‑side code within the context of a user’s browser session. The weakness corresponds to CWE‑79 (XSS) and potentially CWE‑94 (Code Injection) due to the manipulation of unknown functions within the web console.

The vulnerability impacts the QuestDB UI component used in the QuestDB database system. Versions of the UI up to, but not including, 1.1.10 are affected. The fix is contained in commit b42fd9f18476d844ae181a10a249e003dafb823d and will be incorporated into QuestDB 9.3.0 releases; upgrading to 1.1.10 or later resolves the issue.

The CVSS score of 5.1 signifies a moderate severity, while an EPSS score below 1% indicates a low likelihood of exploitation in the wild., the exploit code is publicly available and the attack can be performed remotely via the Web Console interface. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, but its publicly released exploit increases concern for environments that expose the Web Console to remote users.