GitHub Advisoryadvisory · npm

GHSA-9w87-4j72-gcv7 Insecure Default Configuration in graphql-code-generator

HIGH Published 2020-09-02 Modified 2020-08-31 Official page ↗
Ecosystem
npm
Packages
graphql-code-generator
Severity
High
Reviewed
2020-08-31

Affected packages

• npm graphql-code-generator: < 0.18.2 → fixed in 0.18.2

Description

Versions of `graphql-code-generator` prior to 0.18.2 have an Insecure Default Configuration. The packages sets `NODE_TLS_REJECT_UNAUTHORIZED` to 0, disabling certificate verification for the entire project. This results in Insecure Communication for the process. Recommendation Upgrade to version 0.18.2 or later.

References