Reflected XSS in GraphQL Playground
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.
Summary
GraphQL Playground (graphql-playground-html NPM package) before version 1.6.22 have a severe XSS Reflection attack vulnerability. All unsanitized user input passed into renderPlaygroundPage() method could trigger this vulnerability. This has been patched in graphql-playground-html version 1.6.22. Note that some of the associated dependent middleware packages are also affected including but not limited to graphql-playground-middleware-express before version 1.7.16, graphql-playground-middleware-koa before version 1.6.15, graphql-playground-middleware-lambda before version 1.7.17, and graphql-playground-middleware-hapi before 1.6.13.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| prisma-labs | graphql-playground | before 1.6.22 | 1.6.22 | Patch available | CNA |
| — | graphql-playground-html (npm) | before 1.6.22 | 1.6.22 | Patch available | GHSA-4852-vrh7-28rf |
- graphql-playground Vendorprisma-labs Affected before 1.6.22 Fixed in 1.6.22 Patch available CNA
- graphql-playground-html (npm) Vendor— Affected before 1.6.22 Fixed in 1.6.22 Patch available GHSA-4852-vrh7-28rf
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:prisma:graphql-playground-html:*:*:*:*:*:node.js:*:* | before 1.6.22 | Vulnerable | prisma |
| cpe:2.3:a:prisma:graphql-playground-middleware-express:*:*:*:*:*:node.js:*:* | before 1.7.16 | Vulnerable | prisma |
| cpe:2.3:a:prisma:graphql-playground-middleware-hapi:*:*:*:*:*:node.js:*:* | before 1.6.13 | Vulnerable | prisma |
| cpe:2.3:a:prisma:graphql-playground-middleware-koa:*:*:*:*:*:node.js:*:* | before 1.6.15 | Vulnerable | prisma |
| cpe:2.3:a:prisma:graphql-playground-middleware-lambda:*:*:*:*:*:node.js:*:* | before 1.7.17 | Vulnerable | prisma |
- cpe:2.3:a:prisma:graphql-playground-html:*:*:*:*:*:node.js:*:* Versions before 1.6.22 Vulnerable ·prisma
- cpe:2.3:a:prisma:graphql-playground-middleware-express:*:*:*:*:*:node.js:*:* Versions before 1.7.16 Vulnerable ·prisma
- cpe:2.3:a:prisma:graphql-playground-middleware-hapi:*:*:*:*:*:node.js:*:* Versions before 1.6.13 Vulnerable ·prisma
- cpe:2.3:a:prisma:graphql-playground-middleware-koa:*:*:*:*:*:node.js:*:* Versions before 1.6.15 Vulnerable ·prisma
- cpe:2.3:a:prisma:graphql-playground-middleware-lambda:*:*:*:*:*:node.js:*:* Versions before 1.7.17 Vulnerable ·prisma
Remediation
- Fix · CNA graphql-playground (prisma-labs) Fixed in 1.6.22
- Fix · GHSA-4852-vrh7-28rf graphql-playground-html (npm) Fixed in 1.6.22 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2020-4038
- 2026-10-03 Alias added: GHSA-4852-vrh7-28rf
References
Patch 1
Advisory 3
Sources
- CVE-2020-4038 · CVE Program
- CVE-2020-4038 · NVD
- FIRST EPSS
- GHSA-4852-vrh7-28rf · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences