Apollo Embedded Sandbox and Explorer vulnerable to CSRF via window.postMessage origin-validation bypass

Impact A Cross-Site Request Forgery CSRF vulnerability was identified in Apollo’s Embedded Sandbox and Embedded Explorer. The vulnerability arises from missing origin validation in the client-side code that handles window.postMessage events. A malicious website can send forged messages to the...

MAL-2025-47674 Malicious code in gatsby-plugin-apollo-onetrust (npm)

--- -= Per source details. Do not edit below this line.=-...

Apollo Studio Embeddable Explorer & Embeddable Sandbox 跨站请求伪造漏洞

Apollo Studio Embeddable Explorer & Embeddable Sandbox is an open source vectorization tool for Apollo GraphQL. A cross-site request forgery vulnerability exists in Apollo Studio Embeddable Explorer & Embeddable Sandbox, which stems from a lack of source validation when client code handles the...

Malicious code in node-sass-supercluster-izar-apollo (npm)

The package node-sass-supercluster-izar-apollo was found to contain malicious code...

Malicious code in deimos-epimetheus-apollo-fornax (npm)

The package deimos-epimetheus-apollo-fornax was found to contain malicious code...

Malicious code in apollo-nightwatch-xanadu-iota (npm)

The package apollo-nightwatch-xanadu-iota was found to contain malicious code...

MAL-2025-43951 Malicious code in deimos-epimetheus-apollo-fornax (npm)

The package deimos-epimetheus-apollo-fornax was found to contain malicious code...

Malicious code in lithosphere-eris-jwt-apollo (npm)

The package lithosphere-eris-jwt-apollo was found to contain malicious code...

Malicious code in rehype-phoenix-apollo-ceres (npm)

The package rehype-phoenix-apollo-ceres was found to contain malicious code...

Malicious code in rest-meteor-telesto-apollo (npm)

The package rest-meteor-telesto-apollo was found to contain malicious code...

Malicious code in apollo-palynology-hydrogeology-relay (npm)

The package apollo-palynology-hydrogeology-relay was found to contain malicious code...

Malicious code in apollo-development-eridanus-babel (npm)

The package apollo-development-eridanus-babel was found to contain malicious code...

MAL-2025-45822 Malicious code in rest-meteor-telesto-apollo (npm)

The package rest-meteor-telesto-apollo was found to contain malicious code...

MAL-2025-45790 Malicious code in rehype-phoenix-apollo-ceres (npm)

The package rehype-phoenix-apollo-ceres was found to contain malicious code...

MAL-2025-45335 Malicious code in node-sass-supercluster-izar-apollo (npm)

The package node-sass-supercluster-izar-apollo was found to contain malicious code...

MAL-2025-43482 Malicious code in apollo-palynology-hydrogeology-relay (npm)

The package apollo-palynology-hydrogeology-relay was found to contain malicious code...

MAL-2025-45045 Malicious code in lithosphere-eris-jwt-apollo (npm)

The package lithosphere-eris-jwt-apollo was found to contain malicious code...

MAL-2025-43481 Malicious code in apollo-nightwatch-xanadu-iota (npm)

The package apollo-nightwatch-xanadu-iota was found to contain malicious code...

MAL-2025-43480 Malicious code in apollo-development-eridanus-babel (npm)

The package apollo-development-eridanus-babel was found to contain malicious code...

CVE-2025-48168

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in LambertGroup Apollo - Sticky Full Width HTML5 Audio Player lbg-audio5-html5-shoutcast-sticky allows Reflected XSS.This issue affects Apollo - Sticky Full Width HTML5 Audio Player: from n/a through ...