{"action":"Upgrade graphiql to 1.4.7 or later.","affected":[{"fixed":"1.4.7","introduced":"0.5.0"}],"component":"graphiql","cve_ids":["CVE-2021-41248"],"ecosystem":"npm","epss":0.01258,"exploited":false,"fixed_versions":["1.4.7"],"ghsa_id":"GHSA-x4r7-m2q9-69c8","id":"tcs_01M5KGGWWJH8699YTZX7G3J70C","modified_at":"2026-02-04T03:44:17.757498Z","published_at":"2021-11-08T18:03:50Z","references":["https://osv.dev/vulnerability/GHSA-x4r7-m2q9-69c8","https://github.com/graphql/graphiql/security/advisories/GHSA-x4r7-m2q9-69c8","https://github.com/graphql/graphql-playground/security/advisories/GHSA-59r9-6jp6-jcm7","https://nvd.nist.gov/vuln/detail/CVE-2021-41248","https://github.com/graphql/graphiql/commit/6701b0b626e43800e32413590a295e5c1e3d5419#diff-d45eb76aebcffd27d3a123214487116fa95e0b5a11d70a94a0ce3033ce09f879R110","https://github.com/graphql/graphiql/commit/b9dec272d89d9c590727fd10d62e4a47e0317fc7#diff-855b77f6310b7e4fb1bcac779cd945092ed49fd759f4684ea391b45101166437R87","https://github.com/graphql/graphiql/commit/cb237eeeaf7333c4954c752122261db7520f7bf4","https://github.com/graphql/graphiql","https://github.com/graphql/graphiql/blob/main/docs/security/2021-introspection-schema-xss.md#2-more-details-on-the-vulnerability"],"severity":{"label":"high","score":7.1},"sources":[{"source":"osv","source_id":"GHSA-x4r7-m2q9-69c8","url":"https://osv.dev/vulnerability/GHSA-x4r7-m2q9-69c8"}],"summary":"GraphiQL introspection schema template injection attack"}