Graphql Playground
Approved changes feed: RSS · Atom
cpe:2.3:a:graphql:graphql-playground:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Graphql (cd43587a-9f00-5c34-ad98-ddc42ff0b536) |
|---|---|
| Product | Graphql Playground (23e233db-c922-5589-ab86-50e35dfa86d8) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2021-41249 |
vulnerable | 2026-06-08 05:35:20.048674 |
XSS vulnerability in GraphQL Playground
HIGH (7.1)
GraphQL Playground is a GraphQL IDE for development of graphQL focused applications. All versions of graphql-playground-react older than graphql-playground-react@1.7.28 are vulnerable to compromised HTTP schema introspection responses or schema prop values with malicious GraphQL type names, exposing a dynamic XSS attack surface that can allow code injection on operation autocomplete. In order for the attack to take place, the user must load a malicious schema in graphql-playground. There are several ways this can occur, including by specifying the URL to a malicious schema in the endpoint query parameter. If a user clicks on a link to a GraphQL Playground installation that specifies a malicious server, arbitrary JavaScript can run in the user's browser, which can be used to exfiltrate user credentials or other harmful goals. If you are using graphql-playground-react directly in your client app, upgrade to version 1.7.28 or later.
Published: 2021-11-04T20:05:12.000Z
Updated: 2024-08-04T03:08:31.577Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.