@graphql-mesh/cli (>=0.12.0 <=0.19.2), @graphql-mesh/container (>=0.0.4 <=0.0.6) potentially affected by CVE-2021-41248 +1 more via graphql-playground-react (=1.7.27)

graphql-playground-react NPM version =1.7.27 is affected by a known vulnerability. The following packages have a transitive dependency on graphql-playground-react and may be impacted: - @graphql-mesh/cli =0.12.0, =0.0.4, =0.0.6 Source cves: CVE-2021-41248, CVE-2021-41249 Source advisory:...

@abtnode/cli (>=1.8.68 <=1.8.69-beta-e0666d0d), @abtnode/webapp (>=1.8.68 <=1.8.69-beta-e0666d0d) +73 more potentially affected by CVE-2021-41248 +1 more via graphiql (>=0.5.0 <=1.4.6)

graphiql NPM version =0.5.0, =1.8.68, =1.8.68, =2.1.58, =0.1.6, =0.0.0, =0.0.0-nightly-20240830022837, =0.0.0-nightly-20231117021546, =0.0.0-nightly-2020972106, =0.1.1-alpha.19, =0.0.0-nightly-2020972106, =1.7.1, =1.8.68, =1.0.0, =1.0.0-beta.1, =4.1.9 and more Source cves: CVE-2021-41248,...

CVE-2021-41249

creationtimestamp| type| source ---|---|--- 2021-11-04 23:25:38+00:00| seen| https://t.me/cibsecurity/31857...

CVE-2021-41249 XSS vulnerability in GraphQL Playground

GraphQL Playground is a GraphQL IDE for development of graphQL focused applications. All versions of graphql-playground-react older than [email protected] are vulnerable to compromised HTTP schema introspection responses or schema prop values with malicious GraphQL type names,...

CVE-2021-41249

All sources describe a GraphQL Playground XSS in graphql-playground-react older than v1.7.28. The vulnerability arises from compromised HTTP introspection responses or schema prop values containing malicious GraphQL type names, enabling dynamic XSS and potential code execution when a user loads a...