Read the docs
TI-2025-19968 Aliases CVE-2025-27098GHSA-j2wh-wrv3-4x4g

Path traversal in ardatan graphql-mesh

Priority HIGH 66CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-22 and the CVSS impact.

Summary

GraphQL Mesh is a GraphQL Federation framework and gateway for both GraphQL Federation and non-GraphQL Federation subgraphs, non-GraphQL services, such as REST and gRPC, and also databases such as MongoDB, MySQL, and PostgreSQL. Missing check vulnerability in the static file handler allows any client to access the files in the server's file system. When `staticFiles` is set in the `serve` settings in the configuration file, the following handler doesn't check if `absolutePath` is still under the directory provided as `staticFiles`. Users have two options to fix vulnerability; 1. Update `@graphql-mesh/cli` to a version higher than `0.82.21`, and if you use `@graphql-mesh/http`, update it to a version higher than `0.3.18` 2. Remove `staticFiles` option from the configuration, and use other solutions to serve static files.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00364 30th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed @graphql-mesh/cli (npm): 0.82.22@graphql-mesh/http (npm): 0.3.19

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ardatangraphql-mesh@graphql-mesh/cli: >= 0.78.0, < 0.82.22; @graphql-mesh/http: < 0.3.19—No fix listedCNA
—@graphql-mesh/cli (npm)0.78.0 to before 0.82.220.82.22Patch availableGHSA-j2wh-wrv3-4x4g
—@graphql-mesh/http (npm)before 0.3.190.3.19Patch availableGHSA-j2wh-wrv3-4x4g
  • graphql-mesh Vendorardatan Affected @graphql-mesh/cli: >= 0.78.0, < 0.82.22; @graphql-mesh/http: < 0.3.19 Fixed in — No fix listed CNA
  • @graphql-mesh/cli (npm) Vendor— Affected 0.78.0 to before 0.82.22 Fixed in 0.82.22 Patch available GHSA-j2wh-wrv3-4x4g
  • @graphql-mesh/http (npm) Vendor— Affected before 0.3.19 Fixed in 0.3.19 Patch available GHSA-j2wh-wrv3-4x4g

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:the-guild:graphql_mesh_cli:*:*:*:*:*:node.js:*:*0.78.0 to before 0.82.22VulnerableThe-guild
cpe:2.3:a:the-guild:graphql_mesh_http:*:*:*:*:*:node.js:*:*before 0.3.19VulnerableThe-guild
  • cpe:2.3:a:the-guild:graphql_mesh_cli:*:*:*:*:*:node.js:*:* Versions 0.78.0 to before 0.82.22 Vulnerable ·The-guild
  • cpe:2.3:a:the-guild:graphql_mesh_http:*:*:*:*:*:node.js:*:* Versions before 0.3.19 Vulnerable ·The-guild

Remediation

  • Fix · GHSA-j2wh-wrv3-4x4g @graphql-mesh/cli (npm) Fixed in 0.82.22 Advisory →
  • Fix · GHSA-j2wh-wrv3-4x4g @graphql-mesh/http (npm) Fixed in 0.3.19 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-27098
  2. 2026-10-03 Alias added: GHSA-j2wh-wrv3-4x4g

References

Exploit 1

Advisory 1

Other 3

  • TI-2026-82206 Stale connection parameters in GraphQL Tools WebSocket executor CVSS 4.0HIGH 8.2
  • TI-2026-82207 GraphQL Tools legacy WebSocket executor misroutes subscription data CVSS 4.0MEDIUM 6.0
  • TI-2026-85665 Prototype pollution in GraphQL Tools mergeIncrementalResult helper CVSS 4.0HIGH 8.4
  • TI-2026-68299 Prototype pollution in GraphQL Tools mergeDeep function CVSS 4.0HIGH 8.2
  • TI-2026-65765 GraphQL Tools: TLS Certificate Validation Disabled in Legacy GraphQL WebSocket Executor CVSS 3.1HIGH 7.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences