@cedarjs/api-server (>=0.0.4, <=9.0.0-canary.1784), @cedarjs/api-server-watch (>=5.0.7-next.219, <=6.0.0-rc.260) +51 more potentially affected by unknown CVE via @escape.tech/graphql-armor-cost-limit (>=2.0.0, <=2.4.1)

@escape.tech/graphql-armor-cost-limit NPM version =2.0.0, =0.0.4, =5.0.7-next.219, =0.0.4, =5.0.4-next.167, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.9.1-next.19, =0.0.4, =0.0.4, =0.0.2, =2.0.0, =3.1.4 and more Source cves: unknown CVE Source advisory: OSV:GHSA-733V-P3H5-QPQ7...

GraphQL Armor Cost-Limit Plugin Bypass via Introspection Query Obfuscation

Summary A query cost restriction using the cost-limit can be bypassed if ignoreIntrospection is enabled which is the default configuration by naming your query/fragment schema. Details At the start of the computeComplexity function, we have the following check for ignoreIntrospection option: ts i...