Read the docs
TI-2022-16507 Aliases CVE-2022-36084GHSA-qm4w-4995-vg7f

cruddl vulnerable to AQL injection through flexSearch

Priority MEDIUM 46CWE-74Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

cruddl is software for creating a GraphQL API for a database, using the GraphQL SDL to model a schema. If cruddl starting with version 1.1.0 and prior to versions 2.7.0 and 3.0.2 is used to generate a schema that uses `@flexSearchFulltext`, users of that schema may be able to inject arbitrary AQL queries that will be forwarded to and executed by ArangoDB. Schemas that do not use `@flexSearchFulltext` are not affected. The attacker needs to have `READ` permission to at least one root entity type that has `@flexSearchFulltext` enabled. The issue has been fixed in version 3.0.2 and in version 2.7.0 of cruddl. As a workaround, users can temporarily remove `@flexSearchFulltext` from their schemas.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01496 74th percentileScored 2026-11-07
Fix Fixed cruddl (AEB-labs): 3.0.2, 2.7.0cruddl (npm): 3.0.2, 2.7.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
AEB-labscruddl3.0.0 to before 3.0.2; 1.1.0 to before 2.7.03.0.2, 2.7.0Patch availableCNA
—cruddl (npm)3.0.0 to before 3.0.23.0.2Patch availableGHSA-qm4w-4995-vg7f
—cruddl (npm)1.1.0 to before 2.7.02.7.0Patch availableGHSA-qm4w-4995-vg7f
  • cruddl VendorAEB-labs Affected 3.0.0 to before 3.0.2; 1.1.0 to before 2.7.0 Fixed in 3.0.2, 2.7.0 Patch available CNA
  • cruddl (npm) Vendor— Affected 3.0.0 to before 3.0.2 Fixed in 3.0.2 Patch available GHSA-qm4w-4995-vg7f
  • cruddl (npm) Vendor— Affected 1.1.0 to before 2.7.0 Fixed in 2.7.0 Patch available GHSA-qm4w-4995-vg7f

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:aeb:cruddl:*:*:*:*:*:node.js:*:*1.1.0 to before 2.7.0; 3.0.0 to before 3.0.2VulnerableAeb
  • cpe:2.3:a:aeb:cruddl:*:*:*:*:*:node.js:*:* Versions 1.1.0 to before 2.7.0; 3.0.0 to before 3.0.2 Vulnerable ·Aeb

Remediation

  • Fix · CNA cruddl (AEB-labs) Fixed in 3.0.2, 2.7.0
  • Fix · GHSA-qm4w-4995-vg7f cruddl (npm) Fixed in 3.0.2 Advisory →
  • Fix · GHSA-qm4w-4995-vg7f cruddl (npm) Fixed in 2.7.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-36084
  2. 2026-10-03 Alias added: GHSA-qm4w-4995-vg7f

References

Patch 2

Advisory 2

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences