{"action":"Upgrade @genql/cli to 6.3.4 or later.","affected":[{"fixed":"6.3.4","introduced":"0"}],"component":"@genql/cli","cve_ids":["CVE-2026-63397"],"ecosystem":"npm","epss":0.00477,"exploited":false,"fixed_versions":["6.3.4"],"ghsa_id":"GHSA-w757-xvvv-vgfw","id":"tcs_01M5KGE84ZH0CH4FHG56E53RYS","modified_at":"2026-08-13T18:51:16.259274Z","published_at":"2026-07-16T21:30:38Z","references":["https://osv.dev/vulnerability/GHSA-w757-xvvv-vgfw","https://nvd.nist.gov/vuln/detail/CVE-2026-63397","https://github.com/remorses/genql/issues/197","https://github.com/remorses/genql/commit/2dbc80ffb767ee58e6b27d9d81d58fa1ee8bea28","https://github.com/remorses/genql","https://github.com/remorses/genql/releases/tag/%40genql%2Fcli%406.3.4","https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-197-01.json","https://www.cve.org/CVERecord?id=CVE-2026-63397"],"severity":{"label":"medium","score":6.4},"sources":[{"source":"osv","source_id":"GHSA-w757-xvvv-vgfw","url":"https://osv.dev/vulnerability/GHSA-w757-xvvv-vgfw"}],"summary":"Genql: inject arbitrary JavaScript or TypeScript via a GraphQL schema"}