GHSA-5XH2-23CC-5JC6 Strawberry GraphQL has type resolution vulnerability in node interface that allows potential data leakage through incorrect type resolution

Vulnerability Summary A type confusion vulnerability exists in Strawberry GraphQL's relay integration that affects multiple ORM integrations Django, SQLAlchemy, Pydantic. The vulnerability occurs when multiple GraphQL types are mapped to the same underlying model while using the relay node...

Insufficient Type Distinction

Overview strawberry-graphql is an A library for creating GraphQL APIs Affected versions of this package are vulnerable to Insufficient Type Distinction in the relay integration that affects multiple ORM integrations Django, SQLAlchemy, Pydantic. An attacker can access unauthorized data by queryin...

Strawberry GraphQL has type resolution vulnerability in node interface that allows potential data leakage through incorrect type resolution

Vulnerability Summary A type confusion vulnerability exists in Strawberry GraphQL's relay integration that affects multiple ORM integrations Django, SQLAlchemy, Pydantic. The vulnerability occurs when multiple GraphQL types are mapped to the same underlying model while using the relay node...

aas2openapi (>=0.2.0, <=0.2.4), arize-phoenix (>=0.0.33rc5, <=2.11.1) +39 more potentially affected by CVE-2025-22151 via strawberry-graphql (>=0.186.3, <=0.256.1)

strawberry-graphql PYPI version =0.186.3, =0.2.0, =0.0.33rc5, =1.2.0, =0.4.0, =0.2.4, =0.2.6, =0.0.7, =0.1.1, =0.5.0, =0.0.1, =0.0.1, =0.1.4 and more Source cves: CVE-2025-22151 Source advisory: OSV:GHSA-5XH2-23CC-5JC6...

aas2openapi (>=0.2.0, <=0.2.4), arize-phoenix (>=0.0.33rc5, <=2.11.1) +39 more potentially affected by CVE-2025-22151 via strawberry-graphql (>=0.186.3, <=0.256.1)

strawberry-graphql PYPI version =0.186.3, =0.2.0, =0.0.33rc5, =1.2.0, =0.4.0, =0.2.4, =0.2.6, =0.0.7, =0.1.1, =0.5.0, =0.0.1, =0.0.1, =0.1.4 and more Source cves: CVE-2025-22151 Source advisory: GHSA-5XH2-23CC-5JC6...

aas2openapi (>=0.2.0, <=0.2.4), arize-phoenix (>=0.0.33rc5, <=2.11.1) +39 more potentially affected by CVE-2025-22151 via strawberry-graphql (>=0.186.3, <=0.256.1)

strawberry-graphql PYPI version =0.186.3, =0.2.0, =0.0.33rc5, =1.2.0, =0.4.0, =0.2.4, =0.2.6, =0.0.7, =0.1.1, =0.5.0, =0.0.1, =0.0.1, =0.1.4 and more Source cves: CVE-2025-22151 Source advisory: SNYK:PYTHON-STRAWBERRYGRAPHQL-8610312...

CVE-2025-22151

Strawberry GraphQL has a type confusion vulnerability in its relay integration that affects multiple ORM integrations (Django, SQLAlchemy, Pydantic). From version 0.182.0 up to, but not including, 0.257.0, the global node field may resolve to a different type mapped to the same model, causing inf...

CVE-2025-22151 Strawberry GraphQL has a type resolution vulnerability

Strawberry GraphQL is a library for creating GraphQL APIs. Starting in 0.182.0 and prior to version 0.257.0, a type confusion vulnerability exists in Strawberry GraphQL's relay integration that affects multiple ORM integrations Django, SQLAlchemy, Pydantic. The vulnerability occurs when multiple...

CVE-2025-22151

Strawberry GraphQL is a library for creating GraphQL APIs. Starting in 0.182.0 and prior to version 0.257.0, a type confusion vulnerability exists in Strawberry GraphQL's relay integration that affects multiple ORM integrations Django, SQLAlchemy, Pydantic. The vulnerability occurs when multiple...

CVE-2025-22151 Strawberry GraphQL has a type resolution vulnerability

Strawberry GraphQL is a library for creating GraphQL APIs. Starting in 0.182.0 and prior to version 0.257.0, a type confusion vulnerability exists in Strawberry GraphQL's relay integration that affects multiple ORM integrations Django, SQLAlchemy, Pydantic. The vulnerability occurs when multiple...

aas2openapi (>=0.2.0, <=0.2.4), arize-phoenix (>=0.0.33rc5, <=2.11.1) +39 more potentially affected by CVE-2025-22151 via strawberry-graphql (>=0.186.3, <=0.256.1)

strawberry-graphql PYPI version =0.186.3, =0.2.0, =0.0.33rc5, =1.2.0, =0.4.0, =0.2.4, =0.2.6, =0.0.7, =0.1.1, =0.5.0, =0.0.1, =0.0.1, =0.1.4 and more Source cves: CVE-2025-22151 Source advisory: MEND:CVE-2025-22151...

CVE-2025-22151 Strawberry GraphQL has a type resolution vulnerability

Strawberry GraphQL is a library for creating GraphQL APIs. Starting in 0.182.0 and prior to version 0.257.0, a type confusion vulnerability exists in Strawberry GraphQL's relay integration that affects multiple ORM integrations Django, SQLAlchemy, Pydantic. The vulnerability occurs when multiple...

Strawberry GraphQL security vulnerability

Strawberry GraphQL is a Python GraphQL library utilizing type annotations in the Strawberry GraphQL open source. A security vulnerability exists in Strawberry GraphQL versions prior to 0.182.0 through 0.257.0, which stems from type obfuscation in the relay integration, resulting in queries for a...

PT-2025-4385

Name of the Vulnerable Software and Affected Versions Strawberry GraphQL versions 0.182.0 through 0.257.0 Description A type confusion vulnerability exists in Strawberry GraphQL's relay integration, affecting multiple ORM integrations, including Django, SQLAlchemy, and Pydantic. This issue occurs...

CVE-2025-22151: Access of Resource Using Incompatible Type

Strawberry GraphQL is a library for creating GraphQL APIs. Starting in 0.182.0 and prior to version 0.257.0, a type confusion vulnerability exists in Strawberry GraphQL's relay integration that affects multiple ORM integrations Django, SQLAlchemy, Pydantic. The vulnerability occurs when multiple...

GHSA-79GP-Q4WV-33FR Cross-Site Request Forgery (CSRF) in strawberry-graphql

Impact Multipart file upload support as defined in the GraphQL multipart request specification was enabled by default in all Strawberry HTTP view integrations. This made all Strawberry HTTP view integrations vulnerable to CSRF attacks if users did not explicitly enable CSRF preventing security...

aas2openapi (>=0.2.0, <=0.2.4), adelecv (>=0.0.1, <=0.0.2) +61 more potentially affected by CVE-2024-47082 via strawberry-graphql (>=0.16.10, <=0.242.0)

strawberry-graphql PYPI version =0.16.10, =0.2.0, =0.0.1, =0.0.1, =0.1.1, =0.0.2rc0, =1.2.0, =0.1.1, =0.2.0, =0.9.0, =0.4.0, =0.16.0, =0.1.0, =0.1.0, =0.1.4 - flying-delta-callbacks-arize-phoenix 0.0.1 and more Source cves: CVE-2024-47082 Source advisory: OSV:GHSA-79GP-Q4WV-33FR...

aas2openapi (>=0.2.0, <=0.2.4), adelecv (>=0.0.1, <=0.0.2) +61 more potentially affected by CVE-2024-47082 via strawberry-graphql (>=0.16.10, <=0.242.0)

strawberry-graphql PYPI version =0.16.10, =0.2.0, =0.0.1, =0.0.1, =0.1.1, =0.0.2rc0, =1.2.0, =0.1.1, =0.2.0, =0.9.0, =0.4.0, =0.16.0, =0.1.0, =0.1.0, =0.1.4 - flying-delta-callbacks-arize-phoenix 0.0.1 and more Source cves: CVE-2024-47082 Source advisory: GHSA-79GP-Q4WV-33FR...

aas2openapi (>=0.2.0, <=0.2.4), adelecv (>=0.0.1, <=0.0.2) +61 more potentially affected by CVE-2024-47082 via strawberry-graphql (>=0.16.10, <=0.242.0)

strawberry-graphql PYPI version =0.16.10, =0.2.0, =0.0.1, =0.0.1, =0.1.1, =0.0.2rc0, =1.2.0, =0.1.1, =0.2.0, =0.9.0, =0.4.0, =0.16.0, =0.1.0, =0.1.0, =0.1.4 - flying-delta-callbacks-arize-phoenix 0.0.1 and more Source cves: CVE-2024-47082 Source advisory: OSV:PYSEC-2024-171...

CVE-2024-47082

Strawberry GraphQL is a library for creating GraphQL APIs. Prior to version 0.243.0, multipart file upload support as defined in the GraphQL multipart request specification was enabled by default in all Strawberry HTTP view integrations. This made all Strawberry HTTP view integrations vulnerable ...