Vulnerabilities

TI-2026-69808 CVE-2026-107728 · GHSA-pfvf-fwfp-25mp

Strawberry GraphQL permission check can bypass with awaitable results

HIGH 72

Strawberry GraphQL is a library for creating GraphQL APIs.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00449 Published 2026-10-08 Partial fix · 0.326.1 CWE-863

TI-2026-69807 CVE-2026-107727 · GHSA-m952-2w3f-6r8h

Strawberry legacy graphql-ws retains completed subscription slots

MEDIUM 51

Strawberry GraphQL is a library for creating GraphQL APIs.

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.0043 Published 2026-10-08 Partial fix · 0.327.2 CWE-400

TI-2026-35210 CVE-2026-47707 · GHSA-fr49-mhgj-crfc

Strawberry GraphQL's Bypass of MaxAliasesLimiter via Fragment Spreads leading to GraphQL Alias Amplification

MEDIUM 63

Strawberry GraphQL is a library for creating GraphQL APIs.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00466 Published 2026-06-04 Fixed in 0.315.7 CWE-400

TI-2026-33476 CVE-2026-45739 · GHSA-x97m-qp5c-w9xj

Strawberry GraphQL: Default GraphiQL may expose HTTP headers in URLs

LOW 19

Strawberry GraphQL is a library for creating GraphQL APIs.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00218 Published 2026-06-04 Fixed in 0.315.4 CWE-200

TI-2026-35209 CVE-2026-47706 · GHSA-qfwv-87qj-98xq

Strawberry GraphQL has a Circular Fragment Reference DOS

MEDIUM 63

Strawberry GraphQL is a library for creating GraphQL APIs.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00296 Published 2026-06-04 Fixed in 0.315.7 CWE-400

TI-2026-27639 CVE-2026-35523 · GHSA-vpwc-v33q-mq89

Authentication bypass in strawberry-graphql via legacy graphql-ws WebSocket subprotocol

LOW 39

Strawberry GraphQL is a library for creating GraphQL APIs.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0044 Published 2026-04-07 Fixed in 0.312.3 CWE-306

TI-2026-27641 CVE-2026-35526 · GHSA-hv3w-m4g2-5x77

Strawberry GraphQL affected by a Denial of Service via unbounded WebSocket subscriptions

LOW 39

Strawberry GraphQL is a library for creating GraphQL APIs.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00285 Published 2026-04-07 Fixed in 0.312.3 CWE-770

TI-2025-16097 CVE-2025-22151 · GHSA-5xh2-23cc-5jc6

Strawberry GraphQL has a type resolution vulnerability

LOW 18

Strawberry GraphQL is a library for creating GraphQL APIs.

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.00385 Published 2025-01-09 Fixed in 0.257.0 CWE-843

TI-2024-31464 CVE-2024-47082 · GHSA-79gp-q4wv-33fr

Strawberry GraphQL Cross-Site Request Forgery (CSRF) vulnerability

LOW 34

Strawberry GraphQL is a library for creating GraphQL APIs.

CVSS 3.1HIGH 8.0 Network Low privileges User interaction EPSS 0.00244 Published 2024-09-25 Fixed in 0.243.0 CWE-352

TI-2009-01689 CVE-2009-1774 · GHSA-q2j8-pmr3-7jf2

Directory traversal vulnerability in plugins/ddb/foot.php in Strawberry 1.1.1 allows…

MEDIUM 60

Directory traversal vulnerability in plugins/ddb/foot.php in Strawberry 1.1.1 allows remote attackers to include and execute arbitrary local files via a ..

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.23403 Published 2009-05-22 No fix listed CWE-22

Vulnerabilities

Filters