Altair versions from 7.2.4 up to but not including 8.5.8 contain a DOM-based cross-site scripting (XSS) vulnerability in the iframe sandbox plugin configuration. The vulnerability arises because the sandbox page accepts plugin configuration from the iframe sandbox query string and injects attacker-controlled script URLs without proper origin isolation if the sandbox URL is opened directly. This allows arbitrary JavaScript execution in the Altair hosting origin when a victim opens a crafted URL. The issue is fixed in version 8.5.8.