CyberRota Analysis
AI-GeneratedDgraph, an open-source distributed GraphQL database, is vulnerable due to improper handling of regular expression filter strings in its query rewriter, which can lead to injection of DQL operators and unintended data exposure or modification. This high-severity vulnerability affects all versions prior to 25.3.8, and organizations using Dgraph should prioritize upgrading to this version to mitigate the risk of data breaches and unauthorized access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Dgraph is an open source distributed GraphQL database. Prior to 25.3.8, maybeQuoteArg in graphql/resolve/query_rewriter.go passes regexp filter strings into generated DQL without quoting or validating the /pattern/flags form, allowing crafted GraphQL query or mutation filters to inject DQL operators, disclose unintended nodes, or expand modification and deletion targets. This issue is fixed in version 25.3.8.