PT-2026-68761

Name of the Vulnerable Software and Affected Versions Dgraph versions prior to 25.3.8 Description The maybeQuoteArg function in graphql/resolve/query rewriter.go fails to quote or validate the /pattern/flags form when passing regexp filter strings into generated DQL Dgraph Query Language. This...

CVE-2026-63637: Improper Neutralization of Special Elements in Data Query Logic

Dgraph is an open source distributed GraphQL database. Prior to 25.3.8, maybeQuoteArg in graphql/resolve/queryrewriter.go passes regexp filter strings into generated DQL without quoting or validating the /pattern/flags form, allowing crafted GraphQL query or mutation filters to inject DQL...