CVE-2021-41248

npm/graphiql CVE-2021-41248: high 7.1

GraphiQL introspection schema template injection attack

Action: Upgrade graphiql to 1.4.7 or later.

npm i graphiql@1.4.7

Affected

Fixed versions

Sources

• osv: GHSA-x4r7-m2q9-69c8
• https://github.com/graphql/graphiql/security/advisories/GHSA-x4r7-m2q9-69c8
• https://github.com/graphql/graphql-playground/security/advisories/GHSA-59r9-6jp6-jcm7
• https://nvd.nist.gov/vuln/detail/CVE-2021-41248
• https://github.com/graphql/graphiql/commit/6701b0b626e43800e32413590a295e5c1e3d5419#diff-d45eb76aebcffd27d3a123214487116fa95e0b5a11d70a94a0ce3033ce09f879R110
• https://github.com/graphql/graphiql/commit/b9dec272d89d9c590727fd10d62e4a47e0317fc7#diff-855b77f6310b7e4fb1bcac779cd945092ed49fd759f4684ea391b45101166437R87
• https://github.com/graphql/graphiql/commit/cb237eeeaf7333c4954c752122261db7520f7bf4
• https://github.com/graphql/graphiql
• https://github.com/graphql/graphiql/blob/main/docs/security/2021-introspection-schema-xss.md#2-more-details-on-the-vulnerability

CVE-2021-41248 · published 2021-11-08T18:03:50Z · modified 2026-02-04T03:44:17.757498Z · JSON