Gitlab CE/EE 13.4 - 13.6.2 - Information Disclosure Detection

GitLab CE and EE 13.4 through 13.6.2 is susceptible to Information disclosure via GraphQL. User email is visible. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site. !/usr/bin/env python3 --...

Graphql Tartiflette Detect

Detects Graphql Tartiflette Detect. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Graphql Tartiflette Detect.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.probeguard import isspacatchall class ModuleScanner, Httpclient: info = 'name'...

Graphql Apollo Detect

Detects Graphql Apollo Detect. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Graphql Apollo Detect.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Graphql Apollo Detect', 'description': 'Detects Graphql Apoll...

Graphql Go Detect

Detects Graphql Go Detect. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Graphql Go Detect.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Graphql Go Detect', 'description': 'Detects Graphql Go Detect.',...

GraphQL Playground Detection

Detects GraphQL Playground. !/usr/bin/env python3 -- coding: utf-8 -- """Detects GraphQL Playground.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'GraphQL Playground Detection', 'description': 'Detects GraphQL...

Graphql Ariadne Detect

Detects Graphql Ariadne Detect. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Graphql Ariadne Detect.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Graphql Ariadne Detect', 'description': 'Detects Graphql...

GraphQL CSRF / GET method Detection

Cross Site Request Forgery happens when an external website gains ability to make API calls impersonating an user if he visits the website while being authenticated to your API. Allowing API calls through GET requests can lead to CSRF attacks, because cookies are added automatically to GET reques...

Hasura GraphQL Engine - Remote Code Execution Detection

Hasura GraphQL Engine allows remote unauthenticated users to execute arbitrary SQL statements via the '/v2/query' endpoint aka remote code execution. !/usr/bin/env python3 -- coding: utf-8 -- """Hasura GraphQL Engine allows remote unauthenticated users to execute arbitrary SQL statements via the...

Apollo Server GraphQL Introspection - Detect

Apollo Server GraphQL introspection was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Apollo Server GraphQL introspection was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Apollo Server GraphQL...

resterm v0.48.1

Resterm A terminal-native API client and workbench for REST, GraphQL, gRPC, WebSocket and SSE. Resterm is an API-as-code workbench - or, in more familiar terms, an API client - built around plain .http and .rest files that you can diff, review and version. It combines interactive request editing...

PT-2026-65608

Name of the Vulnerable Software and Affected Versions datamodel-code-generator versions 0.25.0 through 0.60.0 Description Code injection occurs when generating Python models from an attacker-controlled GraphQL schema. The issue stems from how GraphQL Union description values are rendered into...

PT-2026-65611

Name of the Vulnerable Software and Affected Versions datamodel-code-generator versions 0.52.1 through 0.60.1 Description When using Pydantic v2 output mode, the software improperly handles data from the --extra-template-data file. Specifically, the process validators function in src/datamodel co...

PT-2026-65614

Name of the Vulnerable Software and Affected Versions datamodel-code-generator versions prior to 0.62.0 Description An unauthenticated path traversal and information disclosure issue exists when the software resolves JSON Schema $ref targets. The application fails to restrict these targets to the...

CVE-2026-54621: Improper Control of Generation of Code

datamodel-code-generator generates Python data models from schema definitions. Prior to 0.60.1, GraphQL Union description values in src/datamodelcodegenerator/model/template/UnionTypeStatement.jinja2 and src/datamodelcodegenerator/model/template/UnionTypeStatement.py312.jinja2 are rendered into...

PT-2026-65658

Summary datamodel-code-generator is vulnerable to code injection when generating Python models from an attacker-controlled GraphQL schema. A description on a Union type, written in the regular-string form "..." with a literal r escape, is rendered into a Python comment by a Jinja2 filter that...

Malicious code in @outsmartly/metaobjects (npm)

Source: amazon-inspector 9ede306bb744e7248af8ac267412edc6cb95f6720dc3fd6f6766b7c3ce915853 On import of the package main, dist/graphql-client.js constructs a singleton CustomGraphQLClient that takes the Shopify API URL built from the caller's METAOBJECTSSHOPIFYSHOP environment variable and...

oxo v2.9.16

OXO Scan Orchestration Engine OXO is a security scanning framework built for modularity, scalability, and simplicity. OXO Engine combines specialized tools to work cohesively to find vulnerabilities and perform actions like recon, enumeration, and fingerprinting. Documentation Agents Store CLI...

resterm v0.47.3

Resterm A terminal-native API client and workbench for REST, GraphQL, gRPC, WebSocket and SSE. Resterm is an API-as-code workbench - or, in more familiar terms, an API client - built around plain .http and .rest files that you can diff, review and version. It combines interactive request editing...

K000162466: Spring GraphQL vulnerability CVE-2026-41856

Security Advisory Description The Spring GraphQL annotation detection mechanism for @Controller data fetchers may not correctly resolve annotations on methods within type hierarchies. This can be an issue if such annotations are used for authorization decisions. When all conditions are met,...

Malicious code in @antstackio/express-graphql-proxy (npm)

Source: amazon-inspector 13ae25cf8547b5efb95597b0e90ea4105e03417563ff724dd9c720c49b4c52d2 The package @antstackio/express-graphql-proxy was found to contain malicious code. Source: google-open-source-security b0fc214b20ef9c0a2a37e3bdc873c1f81ecfede57faba1562c39e53fc7aa28f5 This package was...