Read the docs

graphql

Records3All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high2CVSS 7.0–8.9

Exploited now

graphql records in CISA KEV

No graphql vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Graphiql 1 record LOW Graphql 1 record MEDIUM Playground 1 record LOW

Records

3 records

TI-2023-11368 CVE-2023-26144 · GHSA-9pv7-vfvm-6vr7

Uncontrolled resource consumption in graphql

Priority MEDIUM 63

Versions of the package graphql from 16.3.0 and before 16.8.1 are vulnerable to Denial of Service (DoS) due to insufficient checks in the OverlappingFieldsCanBeMergedRule.ts file when parsing large queries.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01454 Published 2023-09-20 Partial fix · 16.8.1 CWE-400
TI-2021-18084 CVE-2021-41249 · GHSA-59r9-6jp6-jcm7

XSS vulnerability in GraphQL Playground

Priority LOW 34

GraphQL Playground is a GraphQL IDE for development of graphQL focused applications.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.01221 Published 2021-11-04 Fixed in 1.7.28 CWE-79
TI-2021-18083 CVE-2021-41248 · GHSA-x4r7-m2q9-69c8

XSS vulnerability in GraphiQL

Priority LOW 34

GraphiQL is the reference implementation of this monorepo, GraphQL IDE, an official project under the GraphQL Foundation.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.01258 Published 2021-11-04 Fixed in 1.4.7 CWE-79
Open these records in search →