Published: 08/06/2020 Updated: 12/06/2020

CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6

CVSS v3 Base Score: 7.4 | Impact Score: 4 | Exploitability Score: 2.8

VMScore: 384

Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N

GraphQL Playground (graphql-playground-html NPM package) before version 1.6.22 have a severe XSS Reflection attack vulnerability. All unsanitized user input passed into renderPlaygroundPage() method could trigger this vulnerability. This has been patched in graphql-playground-html version 1.6.22. Note that some of the associated dependent middleware packages are also affected including but not limited to graphql-playground-middleware-express before version 1.7.16, graphql-playground-middleware-koa before version 1.6.15, graphql-playground-middleware-lambda before version 1.7.17, and graphql-playground-middleware-hapi prior to 1.6.13.

Vulnerable Product	Search on Vulmon	Subscribe to Product
prisma graphql-playground-html
prisma graphql-playground-middleware-express
prisma graphql-playground-middleware-hapi
prisma graphql-playground-middleware-koa
prisma graphql-playground-middleware-lambda

SECURITY WARNING: both graphql-playground-html and all four (4) of it's middleware dependents until graphql-playground-html@1622 were subject to an XSS Reflection attack vulnerability only to unsanitized user input strings to the functions therein This was resolved in graphql-playground-html@^1622 More Information CVE-2020-4038 Future of this repository: See this i

Note: The primary maintainer @acao is on hiatus until December 2020 SECURITY WARNING: both graphql-playground-html and all four (4) of it's middleware dependents until graphql-playground-html@1622 were subject to an XSS Reflection attack vulnerability only to unsanitized user input strings to the functions therein This was resolved in graphql-playground-html@^1622

SECURITY WARNING: both graphql-playground-html and all four (4) of it's middleware dependents until graphql-playground-html@1622 were subject to an XSS Reflection attack vulnerability only to unsanitized user input strings to the functions therein This was resolved in graphql-playground-html@^1622 More Information CVE-2020-4038 Future of this repository: See this i

🎮 GraphQL IDE for better development workflows (GraphQL Subscriptions, interactive docs & collaboration)

SECURITY WARNING: both graphql-playground-html and all four (4) of it's middleware dependents until graphql-playground-html@1622 were subject to an XSS Reflection attack vulnerability only to unsanitized user input strings to the functions therein This was resolved in graphql-playground-html@^1622 More Information CVE-2020-4038 Future of this repository: See this i

CWE-79 https://github.com/prisma-labs/graphql-playground/commit/bf1883db538c97b076801a60677733816cb3cfb7 https://github.com/prisma-labs/graphql-playground/security/advisories/GHSA-4852-vrh7-28rf https://github.com/prisma-labs/graphql-playground#security-details https://nvd.nist.gov https://github.com/2lambda123/graphql-playground https://github.com/graphql/graphql-playground

CVE-2020-4038

Vulnerability Summary

Vulnerability Trend

Github Repositories

References

Vulmon Search

About

Products

Connect