Malicious code in cli-plugin-graphiql (npm)

The package cli-plugin-graphiql was found to contain malicious code...

MAL-2025-21879 Malicious code in graphiql-rails-fork (npm)

The package graphiql-rails-fork was found to contain malicious code...

MAL-2025-33126 Malicious code in shopify-graphiql-rails (npm)

The package shopify-graphiql-rails was found to contain malicious code...

CVE-2021-41248

GraphiQL is the reference implementation of this monorepo, GraphQL IDE, an official project under the GraphQL Foundation. All versions of graphiql older than [email protected] are vulnerable to compromised HTTP schema introspection responses or schema prop values with malicious GraphQL type names,...

GraphQL Vulnerabilities and Common Attacks: What You Need to Know

GraphQL is a powerful query language for APIs that has gained popularity in recent years for its flexibility and ability to provide a great developer experience. However, with the rise of GraphQL usage comes the potential for security vulnerabilities and attacks. In this blog post, we will descri...

Malicious code in amplify-graphiql-explorer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d1d3e576fc6b5204dca87f9ac269c183497998d162c90a7dcabf36447fa318ec Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-980 Malicious code in amplify-graphiql-explorer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d1d3e576fc6b5204dca87f9ac269c183497998d162c90a7dcabf36447fa318ec Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Spring for GraphQL 1.0 Release

On behalf of the Spring for GraphQL team and every contributor, it is my pleasure to announce the 1.0 GA release. Its been 10 months since the project was announced and under 2 years since the first commit, unremarkably called "first commit". The project began with the modest goal to replace the...

GHSA-X4R7-M2Q9-69C8 GraphiQL introspection schema template injection attack

Impact - 2. Scope - 3. Patches - 3.1 CDN bundle implementations may be automatically patched - 4. Workarounds for Older Versions - 5. How to Re-create the Exploit - 6. Credit - 7. References - 8. For more information This is a security advisory for an XSS vulnerability in graphiql. A similar...

GraphiQL introspection schema template injection attack

Impact - 2. Scope - 3. Patches - 3.1 CDN bundle implementations may be automatically patched - 4. Workarounds for Older Versions - 5. How to Re-create the Exploit - 6. Credit - 7. References - 8. For more information This is a security advisory for an XSS vulnerability in graphiql. A similar...

@1337lawyers/design (>=0.5.2, <=0.12.14), @1337lawyers/gatsby-theme-1337 (0.0.1) +170 more potentially affected by CVE-2021-41248 +1 more via graphiql (>=0.5.0, <=1.4.6)

graphiql NPM version =0.5.0, =0.5.2, =1.1.4, =1.3.1, =1.0.0, =1.7.34, =0.40.0, =0.61.0, =0.15.0, =0.11.0, =5.0.0, =5.7.0, =5.0.0, =1.6.59, =2.1.57 and more Source cves: CVE-2021-41248, CVE-2021-41249 Source advisory: OSV:GHSA-X4R7-M2Q9-69C8...

CVE-2021-41248

GraphiQL is the reference implementation of this monorepo, GraphQL IDE, an official project under the GraphQL Foundation. All versions of graphiql older than [email protected] are vulnerable to compromised HTTP schema introspection responses or schema prop values with malicious GraphQL type names,...

CVE-2021-41248

GraphiQL is the reference implementation of this monorepo, GraphQL IDE, an official project under the GraphQL Foundation. All versions of graphiql older than [email protected] are vulnerable to compromised HTTP schema introspection responses or schema prop values with malicious GraphQL type names,...

Code injection

GraphiQL is the reference implementation of this monorepo, GraphQL IDE, an official project under the GraphQL Foundation. All versions of graphiql older than email protected are vulnerable to compromised HTTP schema introspection responses or schema prop values with malicious GraphQL type names,...

CVE-2021-41248

CVE-2021-41248 affects GraphiQL and all forks where schemas may be loaded from attacker-controlled endpoints. Vulnerable in graphiql and forks prior to [email protected] via compromised HTTP introspection responses or schema props containing malicious GraphQL type names, enabling a dynamic XSS attac...

CVE-2021-41248 XSS vulnerability in GraphiQL

GraphiQL is the reference implementation of this monorepo, GraphQL IDE, an official project under the GraphQL Foundation. All versions of graphiql older than [email protected] are vulnerable to compromised HTTP schema introspection responses or schema prop values with malicious GraphQL type names,...

PT-2021-23212 · Unknown +1 · Graphql-Playground-React +2

Name of the Vulnerable Software and Affected Versions: graphiql versions prior to 1.4.7 graphql-playground-react versions prior to 1.7.28 Description: The vulnerability allows for compromised HTTP schema introspection responses or schema prop values with malicious GraphQL type names, exposing a...

CVE-2021-41248: Improper Neutralization of Input During Web Page Generation

GraphiQL is the reference implementation of this monorepo, GraphQL IDE, an official project under the GraphQL Foundation. All versions of graphiql older than [email protected] are vulnerable to compromised HTTP schema introspection responses or schema prop values with malicious GraphQL type names,...