High, CVSS 7.1npmAmendedPublished
XSS vulnerability in GraphQL Playground from untrusted schemas
CVE-2021-41249 · GHSA-59r9-6jp6-jcm7
- Affected
- npm graphql-playground-react < 1.7.28
- Fixed in
- 1.7.28· Vendor fix available
- Issue
- GraphQL Playground introspection schema template injection attack: Advisory Statement This is a security advisory for an XSS vulnerability in graphql-playground. A similar vulnerability affects graphiql, the package from which graphql-playground was forked. There is a corresponding graphiql advisory. - 1. Impact - 2. Scope - 3. Patches - 4. Reproducing the exploit - 5. Credit - 6. For more information 1. Impact All versions of graphql-playground-react older than graphql-playground-react@1.7.28 are vulnerable to compromised HTTP schema introspection responses or schema prop values with malicious GraphQL type names, exposing a dynamic XSS attack surface that can allow code injection on operation autocomplete. In order for the attack to take place, the user must load a malicious schema in graphql-playground. There are several ways this can occur, including by specifying the URL to a malicious schema in the endpoint query parameter. If a user clicks on a link to a GraphQL Playground…
Recommended action: Upgrade to 1.7.28 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.