@graphql-mesh/cli (>=0.12.0-alpha-892c7bc3.0, <=0.19.2), @graphql-mesh/container (>=0.0.4-alpha-4e6432fb.0, <=0.0.6) potentially affected by CVE-2021-41248 +1 more via graphql-playground-react (1.7.27)

graphql-playground-react NPM version 1.7.27 is affected by a known vulnerability. The following packages have a transitive dependency on graphql-playground-react and may be impacted: - @graphql-mesh/cli =0.12.0-alpha-892c7bc3.0, =0.0.4-alpha-4e6432fb.0, =0.0.6 Source cves: CVE-2021-41248,...

@1337lawyers/design (>=0.5.2, <=0.12.14), @1337lawyers/gatsby-theme-1337 (0.0.1) +170 more potentially affected by CVE-2021-41248 +1 more via graphiql (>=0.5.0, <=1.4.6)

graphiql NPM version =0.5.0, =0.5.2, =1.1.4, =1.3.1, =1.0.0, =1.7.34, =0.40.0, =0.61.0, =0.15.0, =0.11.0, =5.0.0, =5.7.0, =5.0.0, =1.6.59, =2.1.57 and more Source cves: CVE-2021-41248, CVE-2021-41249 Source advisory: OSV:GHSA-X4R7-M2Q9-69C8...

CVE-2021-41249

creationtimestamp| type| source ---|---|--- 2021-11-04 23:25:38+00:00| seen| https://t.me/cibsecurity/31857...

CVE-2021-41249

All sources describe a GraphQL Playground XSS in graphql-playground-react older than v1.7.28. The vulnerability arises from compromised HTTP introspection responses or schema prop values containing malicious GraphQL type names, enabling dynamic XSS and potential code execution when a user loads a...

CVE-2021-41249 XSS vulnerability in GraphQL Playground

GraphQL Playground is a GraphQL IDE for development of graphQL focused applications. All versions of graphql-playground-react older than [email protected] are vulnerable to compromised HTTP schema introspection responses or schema prop values with malicious GraphQL type names,...