@accounter-toolkit/green-invoice-graphql (>=0.0.2-alpha-20220914223128-d706aab, <=0.2.0-alpha-20230313141007-4bdbab6), @accounter-toolkit/hashavshevet-mesh (>=0.0.2-alpha-20220915073207-1bb0680, <=0.0.4-alpha-20230313141007-4bdbab6) +11 more potentially affected by CVE-2025-27098 via @graphql-mesh/http (>=0.1.0-alpha-20220905180614-53fadb778, <=0.3.19-alpha-20230216103821-6e078f7e5)

@graphql-mesh/http NPM version =0.1.0-alpha-20220905180614-53fadb778, =0.0.2-alpha-20220914223128-d706aab, =0.0.2-alpha-20220915073207-1bb0680, =0.0.2-alpha-20220914223128-d706aab, =0.2.0-alpha.24, =5.1.0-canary.3, =6.0.0-canary.20, =6.0.0-canary.20, =6.0.0-canary.20,...

@accounter-toolkit/green-invoice-graphql (>=0.0.2-alpha-20220914223128-d706aab, <=0.2.0-alpha-20230313141007-4bdbab6), @accounter-toolkit/hashavshevet-mesh (>=0.0.2-alpha-20220915073207-1bb0680, <=0.0.4-alpha-20230313141007-4bdbab6) +10 more potentially affected by CVE-2025-27098 via @graphql-mesh/cli (>=0.78.0, <=0.82.21)

@graphql-mesh/cli NPM version =0.78.0, =0.0.2-alpha-20220914223128-d706aab, =0.0.2-alpha-20220915073207-1bb0680, =0.0.2-alpha-20220914223128-d706aab, =0.2.0-alpha.24, =5.1.0-canary.3, =6.0.0-canary.20, =6.0.0-canary.20, =6.0.0-canary.20, =2.2.6-alpha-20220906004558-09c8599, =0.1.147, =0.1.3,...

CVE-2025-27098: Improper Limitation of a Pathname to a Restricted Directory

GraphQL Mesh is a GraphQL Federation framework and gateway for both GraphQL Federation and non-GraphQL Federation subgraphs, non-GraphQL services, such as REST and gRPC, and also databases such as MongoDB, MySQL, and PostgreSQL. Missing check vulnerability in the static file handler allows any...

CVE-2025-27097: Uncontrolled Resource Consumption

GraphQL Mesh is a GraphQL Federation framework and gateway for both GraphQL Federation and non-GraphQL Federation subgraphs, non-GraphQL services, such as REST and gRPC, and also databases such as MongoDB, MySQL, and PostgreSQL. When a user transforms on the root level or single source with...

Graphql-mesh resource management error vulnerability

graphql-mesh is an application by Arda TANRIKULU Individual Developer. A resource management error vulnerability exists in graphql-mesh, which stems from a flaw in the query variable caching mechanism that can lead to token reuse and memory leaks...

GraphQL-Mesh path traversal vulnerability

graphql-mesh is an application by Arda TANRIKULU Individual Developer. A path traversal vulnerability exists in graphql-mesh, which stems from a lack of checks in the static file handler that could lead to arbitrary file reads and leak server data...

PT-2023-36348 · Unknown · Graphql Mesh

Name of the Vulnerable Software and Affected Versions: GraphQL Mesh affected versions not specified Description: GraphQL Mesh is a framework and gateway for GraphQL Federation and non-GraphQL Federation subgraphs, non-GraphQL services, and databases. When a user transforms on the root level or...

@accounter-toolkit/green-invoice-graphql (>=0.0.2-alpha-20220914223128-d706aab, <=0.2.0-alpha-20230313141007-4bdbab6), @accounter-toolkit/hashavshevet-mesh (>=0.0.2-alpha-20220915073207-1bb0680, <=0.0.4-alpha-20230313141007-4bdbab6) +10 more potentially affected by CVE-2025-27098 via @graphql-mesh/cli (>=0.78.0, <=0.82.21)

@graphql-mesh/cli NPM version =0.78.0, =0.0.2-alpha-20220914223128-d706aab, =0.0.2-alpha-20220915073207-1bb0680, =0.0.2-alpha-20220914223128-d706aab, =0.2.0-alpha.24, =5.1.0-canary.3, =6.0.0-canary.20, =6.0.0-canary.20, =6.0.0-canary.20, =2.2.6-alpha-20220906004558-09c8599, =0.1.147, =0.1.3,...

@accounter-toolkit/green-invoice-graphql (>=0.0.2-alpha-20220914223128-d706aab, <=0.2.0-alpha-20230313141007-4bdbab6), @accounter-toolkit/hashavshevet-mesh (>=0.0.2-alpha-20220915073207-1bb0680, <=0.0.4-alpha-20230313141007-4bdbab6) +11 more potentially affected by CVE-2025-27098 via @graphql-mesh/http (>=0.1.0-alpha-20220905180614-53fadb778, <=0.3.19-alpha-20230216103821-6e078f7e5)

@graphql-mesh/http NPM version =0.1.0-alpha-20220905180614-53fadb778, =0.0.2-alpha-20220914223128-d706aab, =0.0.2-alpha-20220915073207-1bb0680, =0.0.2-alpha-20220914223128-d706aab, =0.2.0-alpha.24, =5.1.0-canary.3, =6.0.0-canary.20, =6.0.0-canary.20, =6.0.0-canary.20,...

@accounter-toolkit/green-invoice-graphql (>=0.0.2-alpha-20220914223128-d706aab, <=0.2.0-alpha-20230313141007-4bdbab6), @accounter-toolkit/hashavshevet-mesh (>=0.0.2-alpha-20220915073207-1bb0680, <=0.0.4-alpha-20230313141007-4bdbab6) +11 more potentially affected by CVE-2025-27098 via @graphql-mesh/http (>=0.1.0-alpha-20220905180614-53fadb778, <=0.3.19-alpha-20230216103821-6e078f7e5)

@graphql-mesh/http NPM version =0.1.0-alpha-20220905180614-53fadb778, =0.0.2-alpha-20220914223128-d706aab, =0.0.2-alpha-20220915073207-1bb0680, =0.0.2-alpha-20220914223128-d706aab, =0.2.0-alpha.24, =5.1.0-canary.3, =6.0.0-canary.20, =6.0.0-canary.20, =6.0.0-canary.20,...

@accounter-toolkit/green-invoice-graphql (>=0.0.2-alpha-20220914223128-d706aab, <=0.2.0-alpha-20230313141007-4bdbab6), @accounter-toolkit/hashavshevet-mesh (>=0.0.2-alpha-20220915073207-1bb0680, <=0.0.4-alpha-20230313141007-4bdbab6) +10 more potentially affected by CVE-2025-27098 via @graphql-mesh/cli (>=0.78.0, <=0.82.21)

@graphql-mesh/cli NPM version =0.78.0, =0.0.2-alpha-20220914223128-d706aab, =0.0.2-alpha-20220915073207-1bb0680, =0.0.2-alpha-20220914223128-d706aab, =0.2.0-alpha.24, =5.1.0-canary.3, =6.0.0-canary.20, =6.0.0-canary.20, =6.0.0-canary.20, =2.2.6-alpha-20220906004558-09c8599, =0.1.147, =0.1.3,...

PT-2023-36349 · Unknown · @Graphql-Mesh/Http +1

Name of the Vulnerable Software and Affected Versions: @graphql-mesh/cli versions prior to 0.82.21 @graphql-mesh/http versions prior to 0.3.18 Description: A missing check vulnerability in the static file handler allows any client to access files in the server's file system. When staticFiles is s...

@airy/maleo (>=0.1.0, <=0.3.1-canary.36), @ardatan/graphql-to-config-schema (>=0.1.19, <=0.1.20) +50 more potentially affected by CVE-2022-1650 via eventsource (>=1.0.1, <=1.1.0)

eventsource NPM version =1.0.1, =0.1.0, =0.1.19, =1.1.1, =0.6.0-beta-1, =2.0.1-alpha.18, =4.1.1-alpha-0188b2d.0, =0.4.5-alpha-4d4e438.0, =0.0.5-alpha-cc593a47.0, =0.8.2-alpha-4c2d524a.0, =0.5.2, =0.0.1, =0.0.1, =6.2.8-alpha-006f5787.0, =6.5.1-alpha-3f7e98ee.0, =6.10.0-alpha-a4628cc4.0 -...

@graphql-mesh/cli (>=0.12.0-alpha-892c7bc3.0, <=0.19.2), @graphql-mesh/container (>=0.0.4-alpha-4e6432fb.0, <=0.0.6) potentially affected by CVE-2021-41248 +1 more via graphql-playground-react (1.7.27)

graphql-playground-react NPM version 1.7.27 is affected by a known vulnerability. The following packages have a transitive dependency on graphql-playground-react and may be impacted: - @graphql-mesh/cli =0.12.0-alpha-892c7bc3.0, =0.0.4-alpha-4e6432fb.0, =0.0.6 Source cves: CVE-2021-41248,...

@graphql-mesh/cli (>=0.12.0-alpha-892c7bc3.0, <=0.19.2), @graphql-mesh/container (>=0.0.4-alpha-4e6432fb.0, <=0.0.6) potentially affected by CVE-2021-41249 via graphql-playground-react (1.7.27)

graphql-playground-react NPM version 1.7.27 is affected by a known vulnerability. The following packages have a transitive dependency on graphql-playground-react and may be impacted: - @graphql-mesh/cli =0.12.0-alpha-892c7bc3.0, =0.0.4-alpha-4e6432fb.0, =0.0.6 Source cves: CVE-2021-41249 Source...

@graphql-mesh/cli (>=0.12.0-alpha-892c7bc3.0, <=0.19.2), @graphql-mesh/container (>=0.0.4-alpha-4e6432fb.0, <=0.0.6) potentially affected by CVE-2021-41249 via graphql-playground-react (1.7.27)

graphql-playground-react NPM version 1.7.27 is affected by a known vulnerability. The following packages have a transitive dependency on graphql-playground-react and may be impacted: - @graphql-mesh/cli =0.12.0-alpha-892c7bc3.0, =0.0.4-alpha-4e6432fb.0, =0.0.6 Source cves: CVE-2021-41249 Source...

@graphql-mesh/container (>=0.0.4-alpha-4e6432fb.0, <=0.0.62), @graphql-mesh/openapi (>=0.10.2, <=0.16.9) +13 more potentially affected by unknown CVE via json-ptr (2.0.0)

json-ptr NPM version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on json-ptr and may be impacted: - @graphql-mesh/container =0.0.4-alpha-4e6432fb.0, =0.10.2, =0.5.2, =0.0.2, =0.6.0, =0.0.1, =0.0.2, =0.0.1, =0.0.2, =0.0.2, =0.0.2, =1.0.264,...

@graphql-mesh/container (>=0.0.4-alpha-4e6432fb.0, <=0.0.62), @graphql-mesh/openapi (>=0.10.2, <=0.16.9) +13 more potentially affected by unknown CVE via json-ptr (2.0.0)

json-ptr NPM version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on json-ptr and may be impacted: - @graphql-mesh/container =0.0.4-alpha-4e6432fb.0, =0.10.2, =0.5.2, =0.0.2, =0.6.0, =0.0.1, =0.0.2, =0.0.1, =0.0.2, =0.0.2, =0.0.2, =1.0.264,...

@graphql-mesh/container (>=0.0.4-alpha-4e6432fb.0, <=0.0.62), @graphql-mesh/openapi (>=0.10.2, <=0.16.9) +13 more potentially affected by CVE-2020-7766 via json-ptr (2.0.0)

json-ptr NPM version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on json-ptr and may be impacted: - @graphql-mesh/container =0.0.4-alpha-4e6432fb.0, =0.10.2, =0.5.2, =0.0.2, =0.6.0, =0.0.1, =0.0.2, =0.0.1, =0.0.2, =0.0.2, =0.0.2, =1.0.264,...

@graphql-mesh/container (>=0.0.4-alpha-4e6432fb.0, <=0.0.62), @graphql-mesh/openapi (>=0.10.2, <=0.16.9) +13 more potentially affected by CVE-2020-7766 via json-ptr (2.0.0)

json-ptr NPM version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on json-ptr and may be impacted: - @graphql-mesh/container =0.0.4-alpha-4e6432fb.0, =0.10.2, =0.5.2, =0.0.2, =0.6.0, =0.0.1, =0.0.2, =0.0.1, =0.0.2, =0.0.2, =0.0.2, =1.0.264,...