CVE-2026-5432-GraphQL-Batching-Alias-Confusion-SQL-Injection

7. CVE-2026-5432 – GraphQL 批处理别名混淆 SQL 注入 概述 GraphQL 解析器根据字段别名动态构造 SQL 查询。通过使用批处理和别名，攻击者可以绕过白名单并注入 SQL。 严重性： 严重（数据库接管） Node.js 服务器与漏洞利用 root@kitploit: // vulnerablegraphqlserver.js const express = require'express'; const graphqlHTTP = require'express-graphql'; const buildSchema = require'graphql'...

CVE-2026-81633

CVE-2026-81633 is an improper input validation vulnerability in ash-project ash_graphql (Elixir GraphQL library). The function resolve_node/2 base64-decodes a client-supplied global ID and passes the type segment directly to Map.fetch!/2, which raises an unhandled KeyError when the type is not a ...

CVE-2026-63421

Keystone is a content management system for Node.js. Prior to 6.5.3, the findMany resolver in packages/core/src/lib/core/queries/resolvers.ts compares the signed take argument directly with graphql.maxTake, allowing a remote unauthenticated GraphQL client to provide a negative take value whose...

CVE-2026-63421 Keystone: `graphql.maxTake` bypass with negative `take`

Keystone is a content management system for Node.js. Prior to 6.5.3, the findMany resolver in packages/core/src/lib/core/queries/resolvers.ts compares the signed take argument directly with graphql.maxTake, allowing a remote unauthenticated GraphQL client to provide a negative take value whose...

CVE-2026-63421

Keystone (Node.js CMS) prior to 6.5.3 contains a graphql.maxTake bypass in the findMany resolver (packages/core/src/lib/core/queries/resolvers.ts). The resolver compares the signed take argument directly against the configured maxTake bound, so a remote unauthenticated GraphQL client can supply a...

NL Portal: Missing per-user authorization on document and decision GraphQL queries in nl-portal-backend-libraries

Impact In versions up to and including 3.0.0, two parts of the GraphQL API returned data without checking whether the data belonged to the logged-in user: - Document content. A logged-in user could download the raw content of any document by its ID, regardless of who owned it. The resolver has...

CVE-2026-35413

Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.16.1, when GRAPHQLINTROSPECTION=false is configured, Directus correctly blocks standard GraphQL introspection queries schema, type. However, the serverspecsgraphql resolver on the /graphql/system endpoint...

Allocation of Resources Without Limits or Throttling

Overview directus is a Directus is a real-time API and App dashboard for managing SQL database content. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the GraphQL resolver process. An attacker can exhaust server resources and cause...

CVE-2025-23204

The CVE affects api-platform/core. Starting in version 3.3.8, a logic flaw in the GraphQL security flow is caused by an omitted break in the AccessCheckerProvider switch that is supposed to run after GraphQL resolvers; this fallback can bypass security checks if there is only a post-resolver secu...

WPGraphQL Plugin vulnerable to Server Side Request Forgery (SSRF)

Impact Users with capabilities to upload media editors and above are succeptible to SSRF Server-Side Request Forgery when executing the createMediaItem Mutation. Authenticated users making GraphQL requests that execute the createMediaItem could pass executable paths in the mutations filePath...