PT-2021-23212 · Unknown +1 · Graphql-Playground-React +2

Name of the Vulnerable Software and Affected Versions: graphiql versions prior to 1.4.7 graphql-playground-react versions prior to 1.7.28 Description: The vulnerability allows for compromised HTTP schema introspection responses or schema prop values with malicious GraphQL type names, exposing a...

GraphQL Playground 跨站脚本漏洞

GraphQL Playground is a graphical, interactive, in-browser GraphQL IDE Integrated Development Environment based on GraphiQL from Prisma Labs, Germany. A cross-site scripting vulnerability exists in GraphQL Playground versions prior to 1.4.7, which stems from the software's lack of effective...

GraphQL Playground 跨站脚本漏洞

GraphQL Playground is a graphical, interactive, in-browser GraphQL IDE Integrated Development Environment based on GraphiQL from Prisma Labs, Germany. GraphQL Playground suffers from a cross-site scripting vulnerability that stems from the program's susceptibility to corrupt HTTP schema...

@awoyotoyin/ts-graphql-yoga-express-starter (=1.0.0), @botsbotsbots/api (>=0.1.0-latest.5b715197 <=0.1.0-latest.d90c50ea) +152 more potentially affected by CVE-2020-4038 via graphql-playground-html (>=1.4.1 <=1.6.19)

graphql-playground-html NPM version =1.4.1, =0.1.0-latest.5b715197, =0.1.0, =0.1.1, =1.0.0, =0.0.1-beta, =4.0.0, =1.0.0, =1.7.0, =1.8.81, =1.8.81, =1.8.80, =1.6.26, =1.8.175 and more Source cves: CVE-2020-4038 Source advisory: OSV:GHSA-4852-VRH7-28RF...

GraphQL Playground Cross-Site Scripting Vulnerability

GraphQL Playground is a graphical, interactive, in-browser GraphQL IDE Integrated Development Environment based on GraphiQL from Prisma Labs, Germany. A cross-site scripting vulnerability exists in GraphQL Playground graphql-playground-html NPM package. A remote attacker can exploit this...

CVE-2020-4038

GraphQL Playground graphql-playground-html NPM package before version 1.6.22 have a severe XSS Reflection attack vulnerability. All unsanitized user input passed into renderPlaygroundPage method could trigger this vulnerability. This has been patched in graphql-playground-html version 1.6.22. Not...

Design/Logic Flaw

GraphQL Playground graphql-playground-html NPM package before version 1.6.22 have a severe XSS Reflection attack vulnerability. All unsanitized user input passed into renderPlaygroundPage method could trigger this vulnerability. This has been patched in graphql-playground-html version 1.6.22. Not...

CVE-2020-4038

The CVE-2020-4038 entry concerns GraphQL Playground (graphql-playground-html) with an XSS reflection vulnerability in versions before 1.6.22, triggered by unsanitized input rendered in renderPlaygroundPage(). A patch is available in graphql-playground-html v1.6.22, and related middleware packages...

CVE-2020-4038 Reflected XSS in GraphQL Playground

GraphQL Playground graphql-playground-html NPM package before version 1.6.22 have a severe XSS Reflection attack vulnerability. All unsanitized user input passed into renderPlaygroundPage method could trigger this vulnerability. This has been patched in graphql-playground-html version 1.6.22. Not...