1350 matches found
CVE-2025-59845
CVE-2025-59845 covers a CSRF flaw in Apollo Studio Embeddable Sandbox and Embeddable Explorer caused by missing origin validation in window.postMessage handling. The issue affects embedded Sandbox/Explorer prior to versions 2.7.2 and 3.7.3, allowing a malicious site to forge messages that trigger...
Cross-site Request Forgery (CSRF)
Overview @apollo/sandbox is a This repo hosts the source for Apollo Studio's Embeddable Sandbox Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via missing origin validation in the window.postMessage process. An attacker can execute unauthorized GraphQL queries...
@revisium/admin (>=1.4.0, <=2.0.0) potentially affected by CVE-2025-59845 via @apollo/sandbox (2.7.1)
@apollo/sandbox NPM version 2.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on @apollo/sandbox and may be impacted: - @revisium/admin =1.4.0, =2.0.0 Source cves: CVE-2025-59845 Source advisory: OSV:GHSA-W87V-7W53-WWXV...
Cross-site Request Forgery (CSRF)
Overview @apollo/explorer is a This repo hosts the source for Apollo Studio's Embeddable Explorer Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via missing origin validation in the window.postMessage process. An attacker can execute unauthorized GraphQL queri...
@revisium/admin (>=1.4.0, <=2.0.0) potentially affected by CVE-2025-59845 via @apollo/sandbox (2.7.1)
@apollo/sandbox NPM version 2.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on @apollo/sandbox and may be impacted: - @revisium/admin =1.4.0, =2.0.0 Source cves: CVE-2025-59845 Source advisory: SNYK:JS-APOLLOSANDBOX-13110033...
Apollo Embedded Sandbox and Explorer vulnerable to CSRF via window.postMessage origin-validation bypass
Impact A Cross-Site Request Forgery CSRF vulnerability was identified in Apollo’s Embedded Sandbox and Embedded Explorer. The vulnerability arises from missing origin validation in the client-side code that handles window.postMessage events. A malicious website can send forged messages to the...
MAL-2025-47674 Malicious code in gatsby-plugin-apollo-onetrust (npm)
--- -= Per source details. Do not edit below this line.=-...
CVE-2025-59845: Origin Validation Error
Apollo Studio Embeddable Explorer & Embeddable Sandbox are website embeddable software solutions from Apollo GraphQL. Prior to Apollo Sandbox version 2.7.2 and Apollo Explorer version 3.7.3, a cross-site request forgery CSRF vulnerability was identified. The vulnerability arises from missing orig...
Apollo Studio Embeddable Explorer & Embeddable Sandbox 跨站请求伪造漏洞
Apollo Studio Embeddable Explorer & Embeddable Sandbox is an open source vectorization tool for Apollo GraphQL. A cross-site request forgery vulnerability exists in Apollo Studio Embeddable Explorer & Embeddable Sandbox, which stems from a lack of source validation when client code handles the...
Malicious code in deimos-epimetheus-apollo-fornax (npm)
The package deimos-epimetheus-apollo-fornax was found to contain malicious code...
MAL-2025-45790 Malicious code in rehype-phoenix-apollo-ceres (npm)
The package rehype-phoenix-apollo-ceres was found to contain malicious code...
Malicious code in apollo-development-eridanus-babel (npm)
The package apollo-development-eridanus-babel was found to contain malicious code...
MAL-2025-45045 Malicious code in lithosphere-eris-jwt-apollo (npm)
The package lithosphere-eris-jwt-apollo was found to contain malicious code...
Malicious code in node-sass-supercluster-izar-apollo (npm)
The package node-sass-supercluster-izar-apollo was found to contain malicious code...
MAL-2025-43482 Malicious code in apollo-palynology-hydrogeology-relay (npm)
The package apollo-palynology-hydrogeology-relay was found to contain malicious code...
Malicious code in rest-meteor-telesto-apollo (npm)
The package rest-meteor-telesto-apollo was found to contain malicious code...
Malicious code in rehype-phoenix-apollo-ceres (npm)
The package rehype-phoenix-apollo-ceres was found to contain malicious code...
MAL-2025-45822 Malicious code in rest-meteor-telesto-apollo (npm)
The package rest-meteor-telesto-apollo was found to contain malicious code...