Dgraph is an open source distributed GraphQL database. Prior to 25.3.8, maybeQuoteArg in graphql/resolve/query_rewriter.go passes regexp…
[email protected]·CWE-943·Published 2026-08-06
Dgraph is an open source distributed GraphQL database. Prior to 25.3.8, maybeQuoteArg in graphql/resolve/query_rewriter.go passes regexp filter strings into generated DQL without quoting or validating the /pattern/flags form, allowing crafted GraphQL query or mutation filters to inject DQL operators, disclose unintended nodes, or expand modification and deletion targets. This issue is fixed in version 25.3.8.
Dgraph is an open source distributed GraphQL database. Prior to 25.3.8, maybeQuoteArg in graphql/resolve/query_rewriter.go passes regexp filter strings into generated DQL without quoting or validating the /pattern/flags form, allowing crafted GraphQL query or mutation filters to inject DQL operators, disclose unintended nodes, or expand modification and deletion targets. This issue is fixed in version 25.3.8.
Dgraph es una base de datos GraphQL distribuida de código abierto. Antes de la versión 25.3.8, maybeQuoteArg en graphql/resolve/query_rewriter.go pasa cadenas de filtro regexp a DQL generado sin entrecomillar o validar el formato /patrón/flags, permitiendo que filtros de consulta o mutación GraphQL manipulados inyecten operadores DQL, revelen nodos no deseados o expandan los objetivos de modificación y eliminación. Este problema se solucionó en la versión 25.3.8.
| Version | Type | Source | Base | Exp | Impact | Vector |
|---|---|---|---|---|---|---|
| 3.1 | Primary | cve.org | 8.6 | — | — | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L |
| 3.1 | Primary | cve.org | 8.6 | — | — | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L |
| 3.1 | Secondary | NVD | 8.6 | 3.9 | 4.7 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L |
| 3.1 | Secondary | ENISA EUVD | 8.6 | — | — | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L |