GraphQL Tools EUVD-2026-112473

Four concrete preconditions from the advisory must all hold: (1) a single executor value returned by buildWSLegacyExecutor is reused across callers rather than built per operation; (2) two subscription iterators overlap on an already-OPEN WebSocket, so ensureWebsocket() reuses the socket and the single mutable websocket.onmessage is overwritten; (3) the attacker can cause their own subscription request through that shared executor while the victim's subscription is active and acknowledged (no control over the downstream server is needed); and (4) downstream subscription results differ by user or authorization context so a misrouted payload is an actual disclosure. Limiting factors: the attacker must be an authorized caller on the shared executor (PR:L), the subscriptions must overlap in time (reflected in AC:H/AT:P), and the legacy graphql-ws protocol path must be in use. Applications that construct a new executor per operation - as the in-repo UrlLoader wrapper does at packages/loaders/url/src/index.ts:262-295 - are not affected by the cross-caller leak.

This is a genuine but conditional confidentiality issue, not a high-urgency widespread threat. The vendor-supplied CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:N/VA:L) scores 6.0 (Medium): network-reachable, but with high attack complexity and a present attack requirement (AT:P) reflecting the need for two subscriptions to overlap on an already-OPEN shared socket, plus low privileges (PR:L) because the attacker must be an authorized caller using the same shared executor. Impact is high confidentiality (VC:H, reading another user's authorized subscription payloads) with low availability impact (VA:L, the victim's stream is starved) and no integrity impact. No EPSS score and no KEV listing are provided in the input, and there is no confirmed standalone public exploit; exploitation status is therefore 'no public exploit identified at time of analysis,' although the GHSA advisory documents a verified dynamic reproduction against the published package 1.1.33. The vuln.today Decision label is this_month, consistent with a real, prioritize-this-cycle issue rather than an emergency. The decisive caveat - stated explicitly by the advisory - is that exploitability depends entirely on the consuming application's data flow: it is only exploitable when one executor instance from buildWSLegacyExecutor is shared across mutually untrusted callers, and the full set of affected downstream consumers is unknown. Applications that build a fresh executor per operation (as the in-repo UrlLoader wrapper does) are not affected.

An authorized user of a GraphQL gateway or stitched-schema service that constructs one legacy-WS executor and reuses it per request starts their own subscription while a victim's subscription is active and acknowledged on the same OPEN WebSocket. Because subscribe() overwrites the single websocket.onmessage handler and the DATA branch delivers payloads without comparing data.id to the operation id, the attacker's observer receives the victim's private subscription payloads verbatim with the victim's authorization context, while the victim's stream is starved. The GHSA advisory documents a verified dynamic reproduction of this against published package 1.1.33, though no standalone public exploit is referenced.