CVE-2021-41248

GraphiQL is the reference implementation of this monorepo, GraphQL IDE, an official project under the GraphQL Foundation. All versions of graphiql older than [email protected] are vulnerable to compromised HTTP schema introspection responses or schema prop values with malicious GraphQL type names,...

@graphql-mesh/cli (>=0.12.0-alpha-892c7bc3.0, <=0.19.2), @graphql-mesh/container (>=0.0.4-alpha-4e6432fb.0, <=0.0.6) potentially affected by CVE-2021-41248 +1 more via graphql-playground-react (1.7.27)

graphql-playground-react NPM version 1.7.27 is affected by a known vulnerability. The following packages have a transitive dependency on graphql-playground-react and may be impacted: - @graphql-mesh/cli =0.12.0-alpha-892c7bc3.0, =0.0.4-alpha-4e6432fb.0, =0.0.6 Source cves: CVE-2021-41248,...

@1337lawyers/design (>=0.5.2, <=0.12.14), @1337lawyers/gatsby-theme-1337 (0.0.1) +170 more potentially affected by CVE-2021-41248 +1 more via graphiql (>=0.5.0, <=1.4.6)

graphiql NPM version =0.5.0, =0.5.2, =1.1.4, =1.3.1, =1.0.0, =1.7.34, =0.40.0, =0.61.0, =0.15.0, =0.11.0, =5.0.0, =5.7.0, =5.0.0, =1.6.59, =2.1.57 and more Source cves: CVE-2021-41248, CVE-2021-41249 Source advisory: OSV:GHSA-X4R7-M2Q9-69C8...

CVE-2021-41248

CVE-2021-41248 affects GraphiQL and all forks where schemas may be loaded from attacker-controlled endpoints. Vulnerable in graphiql and forks prior to [email protected] via compromised HTTP introspection responses or schema props containing malicious GraphQL type names, enabling a dynamic XSS attac...