@adamwdennis/nestjs-typeorm-cursor-pagination (1.0.0), @ambak/nest-logger (>=1.0.11, <=1.1.0) +209 more potentially affected by CVE-2026-104852 via @graphql-tools/utils (>=12.0.0-alpha-20260805121238-f73ffd0c8126377e841d94b8bb2db97f34af4c41, <=12.0.1-rc-20260907155438-70f93ec122ac510059d67d2c95fa983767d228e4)

@graphql-tools/utils NPM version =12.0.0-alpha-20260805121238-f73ffd0c8126377e841d94b8bb2db97f34af4c41, =1.0.11, =0.0.1, =1.0.0, =0.0.6, =1.2.5, =2.0.0, =1.0.8, =1.0.0, =1.0.7, =0.0.1, =1.0.0, =0.0.73, =0.0.3, =0.0.44 and more Source cves: CVE-2026-104852 Source advisory:...

Prototype Pollution

Overview @graphql-tools/utils is a Common package containing utils and types for GraphQL tools Affected versions of this package are vulnerable to Prototype Pollution via the mergeDeep function, which fails to block reserved property keys such as proto, constructor, and prototype before recursive...

PT-2026-115963

TuxCare rebuilt @graphql-tools/utils to address 1 CVE. Fixed in 11.2.2-tuxcare.1...

PT-2026-107111

A missing authorization vulnerability was identified in GitHub Enterprise Server that allowed a repository collaborator with write access to delete the current default branch through the GraphQL API and cause an attacker-controlled branch to become the new default. In repositories that required...

CVE-2026-105763: Insufficiently Protected Credentials

Twenty is an open-source CRM customer relationship management platform. From 1.20.10 until 2.7.0, the /metadata GraphQL connectedAccounts query returned connectionParameters from ConnectedAccountDTO for every connected account in a workspace, including plaintext IMAP, SMTP, and CalDAV passwords,...

CVE-2026-103620: Missing Authorization

A missing authorization vulnerability was identified in GitHub Enterprise Server that allowed a repository collaborator with write access to delete the current default branch through the GraphQL API and cause an attacker-controlled branch to become the new default. In repositories that required...

CVE-2026-104852

GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to 12.0.1, the GraphQL Tools utils package's mergeDeep function follows inherited properties while recursively merging source objects and does not exclude proto, constructor, or prototype keys. An...

CVE-2026-105763 Twenty: Plaintext IMAP/SMTP/CalDAV password disclosure to any workspace member via /metadata GraphQL

Twenty is an open-source CRM customer relationship management platform. From 1.20.10 until 2.7.0, the /metadata GraphQL connectedAccounts query returned connectionParameters from ConnectedAccountDTO for every connected account in a workspace, including plaintext IMAP, SMTP, and CalDAV passwords,...

EUVD-2026-92867

Twenty is an open-source CRM customer relationship management platform. From 1.20.10 until 2.7.0, the /metadata GraphQL connectedAccounts query returned connectionParameters from ConnectedAccountDTO for every connected account in a workspace, including plaintext IMAP, SMTP, and CalDAV passwords,...

CVE-2026-105763 Twenty: Plaintext IMAP/SMTP/CalDAV password disclosure to any workspace member via /metadata GraphQL

Twenty is an open-source CRM customer relationship management platform. From 1.20.10 until 2.7.0, the /metadata GraphQL connectedAccounts query returned connectionParameters from ConnectedAccountDTO for every connected account in a workspace, including plaintext IMAP, SMTP, and CalDAV passwords,...

CVE-2026-105763 Twenty: Plaintext IMAP/SMTP/CalDAV password disclosure to any workspace member via /metadata GraphQL

Twenty is an open-source CRM customer relationship management platform. From 1.20.10 until 2.7.0, the /metadata GraphQL connectedAccounts query returned connectionParameters from ConnectedAccountDTO for every connected account in a workspace, including plaintext IMAP, SMTP, and CalDAV passwords,...

CVE-2026-105763

The Twenty open-source CRM platform is vulnerable to plaintext password disclosure in versions 1.20.10 through 2.7.0 . The /metadata GraphQL connectedAccounts query returns connectionParameters for all connected accounts in a workspace without enforcing the calling user's identity or account visi...

EUVD-2026-90922

GraphQL Tools: TLS Certificate Validation Disabled in Legacy GraphQL WebSocket Executor...

GHSA-6FW5-9HQ8-W87G GraphQL Tools: TLS Certificate Validation Disabled in Legacy GraphQL WebSocket Executor

Impact buildWSLegacyExecutor in @graphql-tools/executor-legacy-ws previously hardcoded rejectUnauthorized: false when creating WebSocket connections over WSS. This disabled TLS certificate validation, allowing a network-positioned attacker to perform a Man-in-the-Middle MITM attack against...

@graphql-tools/prisma-loader (>=8.0.0-alpha-20230517123108-df347e95, <=8.0.17-alpha-20241113142246-527bbf8c4e20af3d172439ab4746fe676b3a61c5), @graphql-tools/url-loader (>=8.0.0-alpha-20230517123108-df347e95, <=9.1.9-rc-20260908112455-501eab0b35c6e76223e7ed3d60d6e26c72127f1a) +1 more potentially affected by CVE-2026-103921 via @graphql-tools/executor-legacy-ws (>=1.0.0-alpha-20230517123108-df347e95, <=1.1.35-rc-20260908112455-501eab0b35c6e76223e7ed3d60d6e26c72127f1a)

@graphql-tools/executor-legacy-ws NPM version =1.0.0-alpha-20230517123108-df347e95, =8.0.0-alpha-20230517123108-df347e95, =8.0.0-alpha-20230517123108-df347e95, =9.1.9-rc-20260908112455-501eab0b35c6e76223e7ed3d60d6e26c72127f1a - graphql-config 5.0.0-alpha-20230519081831-037f0ba Source cves:...

GraphQL Tools: TLS Certificate Validation Disabled in Legacy GraphQL WebSocket Executor

Impact buildWSLegacyExecutor in @graphql-tools/executor-legacy-ws previously hardcoded rejectUnauthorized: false when creating WebSocket connections over WSS. This disabled TLS certificate validation, allowing a network-positioned attacker to perform a Man-in-the-Middle MITM attack against...

@graphql-tools/prisma-loader (>=8.0.0-alpha-20230517123108-df347e95, <=8.0.17-alpha-20241113142246-527bbf8c4e20af3d172439ab4746fe676b3a61c5), @graphql-tools/url-loader (>=8.0.0-alpha-20230517123108-df347e95, <=9.1.8-rc-20260907155438-70f93ec122ac510059d67d2c95fa983767d228e4) +1 more potentially affected by CVE-2026-103921 via @graphql-tools/executor-legacy-ws (>=1.0.0-alpha-20230517123108-df347e95, <=1.1.34-rc-20260907155438-70f93ec122ac510059d67d2c95fa983767d228e4)

@graphql-tools/executor-legacy-ws NPM version =1.0.0-alpha-20230517123108-df347e95, =8.0.0-alpha-20230517123108-df347e95, =8.0.0-alpha-20230517123108-df347e95, =9.1.8-rc-20260907155438-70f93ec122ac510059d67d2c95fa983767d228e4 - graphql-config 5.0.0-alpha-20230519081831-037f0ba Source cves:...

GraphQL Tools has prototype pollution in well-established utility function `mergeDeep`

Closed by https://github.com/ardatan/graphql-tools/pull/8423 Mitigated in Hive Gateway by https://github.com/graphql-hive/gateway/pull/2600 A client can alias fields to constructor, proto or prototype so that the response keys from two subgraphs collide on those names during result merging. Becau...

@adamwdennis/nestjs-typeorm-cursor-pagination (1.0.0), @ambak/nest-logger (>=1.0.11, <=1.1.0) +209 more potentially affected by CVE-2026-104852 via @graphql-tools/utils (>=12.0.0-alpha-20260805121238-f73ffd0c8126377e841d94b8bb2db97f34af4c41, <=12.0.1-rc-20260907155438-70f93ec122ac510059d67d2c95fa983767d228e4)

@graphql-tools/utils NPM version =12.0.0-alpha-20260805121238-f73ffd0c8126377e841d94b8bb2db97f34af4c41, =1.0.11, =0.0.1, =1.0.0, =0.0.6, =1.2.5, =2.0.0, =1.0.8, =1.0.0, =1.0.7, =0.0.1, =1.0.0, =0.0.73, =0.0.3, =0.0.44 and more Source cves: CVE-2026-104852 Source advisory: OSV:GHSA-7MX3-VVMW-HJMV...

GHSA-7MX3-VVMW-HJMV GraphQL Tools has prototype pollution in well-established utility function `mergeDeep`

Closed by https://github.com/ardatan/graphql-tools/pull/8423 Mitigated in Hive Gateway by https://github.com/graphql-hive/gateway/pull/2600 A client can alias fields to constructor, proto or prototype so that the response keys from two subgraphs collide on those names during result merging. Becau...