{"action":"Upgrade graphql-playground-react to 1.7.28 or later.","affected":[{"fixed":"1.7.28","introduced":"0"}],"component":"graphql-playground-react","cve_ids":["CVE-2021-41249"],"ecosystem":"npm","epss":0.01221,"exploited":false,"fixed_versions":["1.7.28"],"ghsa_id":"GHSA-59r9-6jp6-jcm7","id":"tcs_01M5KF38JHEY8XDXMVR54AAVQF","modified_at":"2026-02-04T04:25:30.656417Z","published_at":"2021-11-08T18:06:09Z","references":["https://osv.dev/vulnerability/GHSA-59r9-6jp6-jcm7","https://github.com/graphql/graphiql/security/advisories/GHSA-x4r7-m2q9-69c8","https://github.com/graphql/graphql-playground/security/advisories/GHSA-59r9-6jp6-jcm7","https://nvd.nist.gov/vuln/detail/CVE-2021-41249","https://github.com/graphql/graphql-playground/commit/b8a956006835992f12c46b90384a79ab82bcadad","https://github.com/graphql/graphiql/blob/main/docs/security/2021-introspection-schema-xss.md#2-more-details-on-the-vulnerability","https://github.com/graphql/graphql-playground"],"severity":{"label":"high","score":7.1},"sources":[{"source":"osv","source_id":"GHSA-59r9-6jp6-jcm7","url":"https://osv.dev/vulnerability/GHSA-59r9-6jp6-jcm7"}],"summary":"XSS vulnerability in GraphQL Playground from untrusted schemas"}