GitHub Advisoryadvisory · npm

GHSA-w757-xvvv-vgfw Genql: inject arbitrary JavaScript or TypeScript via a GraphQL schema

HIGH Published 2026-07-16 Modified 2026-08-13 Official page ↗
Aliases
CVE-2026-63397
Ecosystem
npm
Packages
@genql/cli
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-116
Reviewed
2026-08-13

Affected packages

• npm @genql/cli: < 6.3.4 → fixed in 6.3.4

Description

remorses/genql before version 6.3.4 allows an authenticated attacker with control of the GraphQL schema that is passed to genql to inject arbitrary JavaScript or TypeScript. The malicious code is injected into the generated schema.ts file and executes when the genql client is bundled and imported.

Related

Alias · CVE (1)

  • CVE-2026-63397 remorses/genql before version 6.3.4 allows an authenticated attacker with control of the GraphQL schema that is passed to genql to inject… vulnerability

Weakness · CWE (1)

  • CWE-116 Improper Encoding or Escaping of Output weakness

References