Strawberry GraphQL has type resolution vulnerability in node interface that allows potential data leakage through incorrect type resolution

Vulnerability Summary A type confusion vulnerability exists in Strawberry GraphQL's relay integration that affects multiple ORM integrations Django, SQLAlchemy, Pydantic. The vulnerability occurs when multiple GraphQL types are mapped to the same underlying model while using the relay node...

aas2openapi (>=0.2.0, <=0.2.4), arize-phoenix (>=0.0.33rc5, <=2.11.1) +38 more potentially affected by CVE-2025-22151 via strawberry-graphql (>=0.186.3, <=0.256.1)

strawberry-graphql PYPI version =0.186.3, =0.2.0, =0.0.33rc5, =1.2.0, =0.4.0, =0.2.4, =0.2.6, =0.0.7, =0.1.1, =0.5.0, =0.0.1, =0.0.1, =0.23.15, =0.26.0 and more Source cves: CVE-2025-22151 Source advisory: OSV:GHSA-5XH2-23CC-5JC6...

aas2openapi (>=0.2.0, <=0.2.4), arize-phoenix (>=0.0.33rc5, <=2.11.1) +38 more potentially affected by CVE-2025-22151 via strawberry-graphql (>=0.186.3, <=0.256.1)

strawberry-graphql PYPI version =0.186.3, =0.2.0, =0.0.33rc5, =1.2.0, =0.4.0, =0.2.4, =0.2.6, =0.0.7, =0.1.1, =0.5.0, =0.0.1, =0.0.1, =0.23.15, =0.26.0 and more Source cves: CVE-2025-22151 Source advisory: GHSA-5XH2-23CC-5JC6...

GHSA-5XH2-23CC-5JC6 Strawberry GraphQL has type resolution vulnerability in node interface that allows potential data leakage through incorrect type resolution

Vulnerability Summary A type confusion vulnerability exists in Strawberry GraphQL's relay integration that affects multiple ORM integrations Django, SQLAlchemy, Pydantic. The vulnerability occurs when multiple GraphQL types are mapped to the same underlying model while using the relay node...

Insufficient Type Distinction

Overview strawberry-graphql is an A library for creating GraphQL APIs Affected versions of this package are vulnerable to Insufficient Type Distinction in the relay integration that affects multiple ORM integrations Django, SQLAlchemy, Pydantic. An attacker can access unauthorized data by queryin...

aas2openapi (>=0.2.0, <=0.2.4), arize-phoenix (>=0.0.33rc5, <=2.11.1) +38 more potentially affected by CVE-2025-22151 via strawberry-graphql (>=0.186.3, <=0.256.1)

strawberry-graphql PYPI version =0.186.3, =0.2.0, =0.0.33rc5, =1.2.0, =0.4.0, =0.2.4, =0.2.6, =0.0.7, =0.1.1, =0.5.0, =0.0.1, =0.0.1, =0.23.15, =0.26.0 and more Source cves: CVE-2025-22151 Source advisory: SNYK:PYTHON-STRAWBERRYGRAPHQL-8610312...

CVE-2025-22151

Strawberry GraphQL is a library for creating GraphQL APIs. Starting in 0.182.0 and prior to version 0.257.0, a type confusion vulnerability exists in Strawberry GraphQL's relay integration that affects multiple ORM integrations Django, SQLAlchemy, Pydantic. The vulnerability occurs when multiple...

CVE-2025-22151 Strawberry GraphQL has a type resolution vulnerability

Strawberry GraphQL is a library for creating GraphQL APIs. Starting in 0.182.0 and prior to version 0.257.0, a type confusion vulnerability exists in Strawberry GraphQL's relay integration that affects multiple ORM integrations Django, SQLAlchemy, Pydantic. The vulnerability occurs when multiple...

CVE-2025-22151 Strawberry GraphQL has a type resolution vulnerability

Strawberry GraphQL is a library for creating GraphQL APIs. Starting in 0.182.0 and prior to version 0.257.0, a type confusion vulnerability exists in Strawberry GraphQL's relay integration that affects multiple ORM integrations Django, SQLAlchemy, Pydantic. The vulnerability occurs when multiple...

aas2openapi (>=0.2.0, <=0.2.4), arize-phoenix (>=0.0.33rc5, <=2.11.1) +38 more potentially affected by CVE-2025-22151 via strawberry-graphql (>=0.186.3, <=0.256.1)

strawberry-graphql PYPI version =0.186.3, =0.2.0, =0.0.33rc5, =1.2.0, =0.4.0, =0.2.4, =0.2.6, =0.0.7, =0.1.1, =0.5.0, =0.0.1, =0.0.1, =0.23.15, =0.26.0 and more Source cves: CVE-2025-22151 Source advisory: MEND:CVE-2025-22151...

CVE-2025-22151 Strawberry GraphQL has a type resolution vulnerability

Strawberry GraphQL is a library for creating GraphQL APIs. Starting in 0.182.0 and prior to version 0.257.0, a type confusion vulnerability exists in Strawberry GraphQL's relay integration that affects multiple ORM integrations Django, SQLAlchemy, Pydantic. The vulnerability occurs when multiple...

CVE-2025-22151

Strawberry GraphQL has a type confusion vulnerability in its relay integration that affects multiple ORM integrations (Django, SQLAlchemy, Pydantic). From version 0.182.0 up to, but not including, 0.257.0, the global node field may resolve to a different type mapped to the same model, causing inf...

Strawberry GraphQL security vulnerability

Strawberry GraphQL is a Python GraphQL library utilizing type annotations in the Strawberry GraphQL open source. A security vulnerability exists in Strawberry GraphQL versions prior to 0.182.0 through 0.257.0, which stems from type obfuscation in the relay integration, resulting in queries for a...

PT-2025-4385

Name of the Vulnerable Software and Affected Versions Strawberry GraphQL versions 0.182.0 through 0.257.0 Description A type confusion vulnerability exists in Strawberry GraphQL's relay integration, affecting multiple ORM integrations, including Django, SQLAlchemy, and Pydantic. This issue occurs...

CVE-2025-22151: Access of Resource Using Incompatible Type

Strawberry GraphQL is a library for creating GraphQL APIs. Starting in 0.182.0 and prior to version 0.257.0, a type confusion vulnerability exists in Strawberry GraphQL's relay integration that affects multiple ORM integrations Django, SQLAlchemy, Pydantic. The vulnerability occurs when multiple...

graphql-java:GraphqlFuzzer: Security exception in java.base/java.nio.ByteBuffer.wrap

Detailed Report: https://oss-fuzz.com/testcase?key=6237409125138432 Project: graphql-java Fuzzing Engine: libFuzzer Fuzz Target: GraphqlFuzzer Job Type: libfuzzerasangraphql-java Platform Id: linux Crash Type: Security exception Crash Address: Crash State: java.base/java.nio.ByteBuffer.wrap...

VulnCheck KEV: CVE-2023-47643

SuiteCRM is a Customer Relationship Management CRM software application. Prior to version 8.4.2, Graphql Introspection is enabled without authentication, exposing the scheme defining all object types, arguments, and functions. An attacker can obtain the GraphQL schema and understand the entire...

ai.acolite:openai-agent-sdk (>=0.1.0, <=0.4.0), ai.ancf.lmos-router:lmos-router-llm-in-spring-cloud-gateway-demo (>=0.2.0, <=0.28.0) +19933 more potentially affected by CVE-2024-12801 via ch.qos.logback:logback-core (>=1.4.0, <=1.5.12)

ch.qos.logback:logback-core MAVEN version =1.4.0, =0.1.0, =0.2.0, =0.1.1, =0.1.1, =0.1.1, =0.0.4, =0.1.0, =0.9.0 - ai.chat2db.excel:easyexcel-plus-test 0.0.1 - ai.djl.spring:djl-spring-boot-starter-autoconfigure 0.26 - ai.djl.spring:djl-spring-boot-starter-mxnet-auto 0.26 -...

Unauthorized Access

directus is vulnerable to Unauthorized Access. The vulnerability is due to improper authentication handling when WEBSOCKETSGRAPHQLAUTH or WEBSOCKETSRESTAUTH is set to "public," allowing unauthenticated users to perform CRUD operations and subscribe to changes with full admin privileges...

Altair Resource Management Error Vulnerability

Altair is a beautiful and feature-rich GraphQL client IDE from the Altair GraphQL open source. A resource management error vulnerability exists in versions prior to Altair v12.24Q3.2, which stems from a lack of request validation and a lack of authentication in the image proxy, and the...