Graphql
CVE-2021-41249
MEDIUM
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | CVSS score of 4.7 (MEDIUM). Attack characteristics: network attack vector, high complexity, no privileges required, user interaction required. |
| Exploit ScenarioDerived | A remote attacker could inject malicious scripts into web pages viewed by other users by sending crafted requests to the affected application. No authentication is required to exploit this vulnerability. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAI
GraphQL Playground is a GraphQL IDE for development of graphQL focused applications. Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, no authentication required. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
RemediationAI
A vendor patch is available. Apply the latest security update as soon as possible. Sanitize all user input, use Content-Security-Policy headers, encode output contextually (HTML, JS, URL). Use frameworks with built-in XSS protection.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in npm
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability is classified as Cross-Site Scripting (XSS) (CWE-79), which allows attackers to inject malicious scripts into web pages viewed by other users. GraphQL Playground is a GraphQL IDE for development of graphQL focused applications. All versions of graphql-playground-react older than graphql-playground-react@1.7.28 are vulnerable to compromised HTTP schema introspection responses or schema prop values with malicious GraphQL type names, exposing a dynamic XSS attack surface that can allow code injection on operation autocomplete. In order for the attack to take place, the user must load a malicious schema in graphql-playground. There are several ways this can occur, including by specifying the URL to a malicious schema in the endpoint query parameter. If a user clicks on a link to a GraphQL Playground installation that specifies a malicious server, arbitrary JavaScript can run in the user's browser, which can be used to exfiltrate user credentials or other harmful goals. If you are using graphql-playground-react directly in your client app, upgrade to version 1.7.28 or later. Affected products include: Graphql Playground. Version information: version 1.7.28.
Know when Graphql gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionNVD
GraphQL Playground is a GraphQL IDE for development of graphQL focused applications. All versions of graphql-playground-react older than graphql-playground-react@1.7.28 are vulnerable to compromised HTTP schema introspection responses or schema prop values with malicious GraphQL type names, exposing a dynamic XSS attack surface that can allow code injection on operation autocomplete. In order for the attack to take place, the user must load a malicious schema in graphql-playground. There are several ways this can occur, including by specifying the URL to a malicious schema in the endpoint query parameter. If a user clicks on a link to a GraphQL Playground installation that specifies a malicious server, arbitrary JavaScript can run in the user's browser, which can be used to exfiltrate user credentials or other harmful goals. If you are using graphql-playground-react directly in your client app, upgrade to version 1.7.28 or later.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Affected Products (CPE)NVD
Unauthenticated denial of service in GitLab CE/EE (all versions from 18.4.6 before 19.1.8, 19.2 before 19.2.6, and 19.3
Unauthenticated attackers can publish arbitrary persisted query documents and claim (squat) query aliases on WordPress s
Stump through 0.1.10 allows any authenticated user with the shared AccessSmartList permission to overwrite, delete, or t
Authorization bypass in Craft CMS 5.0.0 through 5.10.x allows an authenticated holder of a narrowly site-scoped GraphQL
Versions of the package graphql from 16.3.0 and before 16.8.1 are vulnerable to Denial of Service (DoS) due to insuffici
Server-side request forgery in Chaskiq through 2.0.3 allows unauthenticated attackers to make the server fetch arbitrary
Prototype pollution in `@graphql-tools/utils` `mergeDeep()` lets a remote, unauthenticated client submit a single aliase
JWT authentication bypass in @neo4j/graphql allows unauthenticated remote clients to forge arbitrary JWT claims over Gra
Uncontrolled resource consumption in the Strawberry GraphQL library's legacy graphql-ws subscription handler (versions 0
Authentication bypass in @neo4j/graphql exposes admin-restricted custom-resolver fields to any authenticated user holdin
silverstripe-graphql is a package which serves Silverstripe data in GraphQL representations. Rated high severity (CVSS 7
`silverstripe/graphql` serves Silverstripe data as GraphQL representations. Rated high severity (CVSS 7.5), this vulnera
Exploit-DB