Cross-site Scripting (XSS)

2020-06-0902:48:52

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.002 Low

EPSS

Percentile

52.1%

JSON

graphql-playground-html is vulnerable to cross-site scripting (XSS). The vulnerability exists through the improper handling of user input in renderPlaygroundPage().

CPENameOperatorVersion
@apollographql/graphql-playground-htmlle1.6.19
graphql-playground-htmlle1.6.19
graphql-playground-htmlle1.6.19

Name	Operator	Version
@apollographql/graphql-playground-html	le	1.6.19
graphql-playground-html	le	1.6.19
graphql-playground-html	le	1.6.19

References

github.com/prisma-labs/graphql-playground#security-details

github.com/prisma-labs/graphql-playground/commit/bf1883db538c97b076801a60677733816cb3cfb7

github.com/prisma-labs/graphql-playground/security/advisories/GHSA-4852-vrh7-28rf

0.002 Low

EPSS

Percentile

52.1%

JSON

Related for VERACODE:25639