Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

graphql-playground-html

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.4npmAmendedPublished

    Reflected XSS in GraphQL Playground

    CVE-2020-4038 · GHSA-4852-vrh7-28rf

    Affected
    • npm graphql-playground-html < 1.6.22
    Fixed in
    1.6.22· Vendor fix available
    Issue
    Impact directly impacted: - graphql-playground-html@<1.6.22 - all unsanitized user input for renderPlaygroundPage() all of our consuming packages of graphql-playground-html are impacted: - graphql-playground-middleware-express@<1.7.16 - unsanitized user input to expressPlayground() - graphql-playground-middleware-koa@<1.6.15 - unsanitized user input to koaPlayground() - graphql-playground-middleware-lambda@<1.7.17 - unsanitized user input to lambdaPlayground() - graphql-playground-middleware-hapi@<1.6.13 - unsanitized user input to hapiPlayground() as well as any other packages that use these methods with unsanitized user input. not impacted: - graphql-playground-electron - uses renderPlaygroundPage() statically for a webpack build for electron bundle, no dynamic user input - graphql-playground-react - usage of the component directly in a react application does not expose reflected XSS vulnerabilities. only the demo in public/ contains the vulnerability, because it uses an old…

    Recommended action: Upgrade to 1.6.22 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →