CVE-2021-41249 XSS vulnerability in GraphQL Playground
Attackers can execute arbitrary JavaScript in users' browsers via malicious GraphQL schemas, potentially stealing credentials.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2021-41249?
CVE-2021-41249 is a high-severity cross-site scripting vulnerability in graphql-playground, published on 4 Nov 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
GraphQL Playground is a GraphQL IDE for development of graphQL focused applications. All versions of graphql-playground-react older than [email protected] are vulnerable to compromised HTTP schema introspection responses or schema prop values with malicious GraphQL type names, exposing a dynamic XSS attack surface that can allow code injection on operation autocomplete. In order for the attack to take place, the user must load a malicious schema in graphql-playground. There are several ways this can occur, including by specifying the URL to a malicious schema in the endpoint query parameter. If a user clicks on a link to a GraphQL Playground installation that specifies a malicious server, arbitrary JavaScript can run in the user's browser, which can be used to exfiltrate user credentials or other harmful goals. If you are using graphql-playground-react directly in your client app, upgrade to version 1.7.28 or later.
Weakness: CWE-79
Which versions are affected by CVE-2021-41249?
2 open source packages ship an affected version, including graphql-playground-react. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
graphql-playground-react npm | All versions | 1.7.28 |
graphql-playground-react npm | All versions | 1.7.28 |
Products include Graphql Playground.
How do I fix CVE-2021-41249?
Upgrade graphql-playground-react to 1.7.28 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2021-41249 being exploited?
There is no known exploitation of CVE-2021-41249 in the wild and no public exploit code.
Sources
Also known as GHSA-59r9-6jp6-jcm7.