GHSA-xf64-2f9p-6pqq Information Exposure in type-graphql
Attackers can leak resolver source code by sending requests without subscription topics, exposing internal logic.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-xf64-2f9p-6pqq?
GHSA-xf64-2f9p-6pqq is a vulnerability in type-graphql, published on 4 Sep 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Versions of type-graphql prior to 0.17.6 are vulnerable to Information Exposure. The package leaks the resolver source code in an error message. It is possible to force this error when no subscription topics are provided in the request.
Recommendation
Upgrade to version 0.17.6 or later.
Which versions are affected by GHSA-xf64-2f9p-6pqq?
2 open source packages ship an affected version, including type-graphql.
| Package | Affected | Fixed in |
|---|---|---|
type-graphql npm | All versions | 0.17.6 |
type-graphql npm | All versions | 0.17.6 |
How do I fix GHSA-xf64-2f9p-6pqq?
Upgrade type-graphql to 0.17.6 or later.
Is GHSA-xf64-2f9p-6pqq being exploited?
There is no known exploitation of GHSA-xf64-2f9p-6pqq in the wild and no public exploit code.