remorses/genql before version 6.3.4 allows an authenticated attacker with control of the GraphQL schema that is passed to genql to inject arbitrary JavaScript or TypeScript.
CVSS 4.0HIGH 7.1·Network·High privileges·User interaction·EPSS 0.00477·Published 2026-07-16·Fixed in 6.3.4CWE-116