GHSA-9w87-4j72-gcv7 Insecure Default Configuration in graphql-code-generator
The library disables TLS certificate verification by default, allowing attackers to intercept or manipulate network traffic via man-in-the-middle attacks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-9w87-4j72-gcv7?
GHSA-9w87-4j72-gcv7 is a vulnerability in graphql-code-generator, published on 2 Sep 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Versions of graphql-code-generator prior to 0.18.2 have an Insecure Default Configuration. The packages sets NODE_TLS_REJECT_UNAUTHORIZED to 0, disabling certificate verification for the entire project. This results in Insecure Communication for the process.
Recommendation
Upgrade to version 0.18.2 or later.
Which versions are affected by GHSA-9w87-4j72-gcv7?
2 open source packages ship an affected version, including graphql-code-generator.
| Package | Affected | Fixed in |
|---|---|---|
graphql-code-generator npm | All versions | 0.18.2 |
graphql-code-generator npm | All versions | 0.18.2 |
How do I fix GHSA-9w87-4j72-gcv7?
Upgrade graphql-code-generator to 0.18.2 or later.
Is GHSA-9w87-4j72-gcv7 being exploited?
There is no known exploitation of GHSA-9w87-4j72-gcv7 in the wild and no public exploit code.