GHSA-W757-XVVV-VGFW Genql: inject arbitrary JavaScript or TypeScript via a GraphQL schema

remorses/genql before version 6.3.4 allows an authenticated attacker with control of the GraphQL schema that is passed to genql to inject arbitrary JavaScript or TypeScript. The malicious code is injected into the generated schema.ts file and executes when the genql client is bundled and imported...

Genql: inject arbitrary JavaScript or TypeScript via a GraphQL schema

remorses/genql before version 6.3.4 allows an authenticated attacker with control of the GraphQL schema that is passed to genql to inject arbitrary JavaScript or TypeScript. The malicious code is injected into the generated schema.ts file and executes when the genql client is bundled and imported...

@alphasense/sdk-cli (>=0.0.4, <=1.0.4), @bsmnt/sdk-gen (2.0.5) +1 more potentially affected by CVE-2026-63397 via @genql/cli (>=6.0.0, <=6.3.3)

@genql/cli NPM version =6.0.0, =0.0.4, =0.0.2, =3.1.10 Source cves: CVE-2026-63397 Source advisory: OSV:GHSA-W757-XVVV-VGFW...

CVE-2026-63397

CVE-2026-63397 : The NVD/CVE entries describe a vulnerability in remorses/genql prior to version 6.3.4 where an authenticated attacker who can control the GraphQL schema passed to genql can inject arbitrary JavaScript or TypeScript. The injected code is written into the generated schema.ts file a...

CVE-2026-63397 remorses/genql code injection

remorses/genql before version 6.3.4 allows an authenticated attacker with control of the GraphQL schema that is passed to genql to inject arbitrary JavaScript or TypeScript. The malicious code is injected into the generated schema.ts file and executes when the genql client is bundled and imported...

CVE-2026-63397 remorses/genql code injection

remorses/genql before version 6.3.4 allows an authenticated attacker with control of the GraphQL schema that is passed to genql to inject arbitrary JavaScript or TypeScript. The malicious code is injected into the generated schema.ts file and executes when the genql client is bundled and imported...

remorses/genql code injection

RISK EVALUATION remorses/genql before version 6.3.4 allows an authenticated attacker with control of the GraphQL schema that is passed to genql to inject arbitrary JavaScript or TypeScript. The malicious code is injected into the generated schema.ts file and executes when the genql client is...

CVE-2026-63397: Improper Encoding or Escaping of Output

remorses/genql before version 6.3.4 allows an authenticated attacker with control of the GraphQL schema that is passed to genql to inject arbitrary JavaScript or TypeScript. The malicious code is injected into the generated schema.ts file and executes when the genql client is bundled and imported...