graphql-playground-html

graphql-playground-html

Releases56

Frequency3 weeks 5 days

Last Releaseover 4 years ago

GraphQL IDE for better development workflows (GraphQL Subscriptions, interactive docs & collaboration).

Log in to subscribe

CVE History

CVE	Affected	Published	CVSS v3	CVSS v2
CVE-2020-4038OSV↗	< 1.6.22	Jun 8, 2020Monday, 8 June 2020, 21:15	7.4 HIGH	4.3 MEDIUM
GraphQL Playground (graphql-playground-html NPM package) before version 1.6.22 have a severe XSS Reflection attack vulnerability. All unsanitized user input passed into renderPlaygroundPage() method could trigger this vulnerability. This has been patched in graphql-playground-html version 1.6.22. Note that some of the associated dependent middleware packages are also affected including but not limited to graphql-playground-middleware-express before version 1.7.16, graphql-playground-middleware-koa before version 1.6.15, graphql-playground-middleware-lambda before version 1.7.17, and graphql-playground-middleware-hapi before 1.6.13.