CyberRota Analysis
AI-GeneratedThe vulnerability affects versions of the genql library prior to 6.3.4, allowing authenticated attackers to inject arbitrary JavaScript or TypeScript into the generated schema.ts file by manipulating the GraphQL schema. This could lead to the execution of malicious code when the genql client is bundled and imported, potentially compromising the integrity of applications using this library. Developers and organizations utilizing genql in their Java applications should prioritize patching to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
remorses/genql before version 6.3.4 allows an authenticated attacker with control of the GraphQL schema that is passed to genql to inject arbitrary JavaScript or TypeScript. The malicious code is injected into the generated schema.ts file and executes when the genql client is bundled and imported.