Vulnerability Description
GraphQL Playground (graphql-playground-html NPM package) before version 1.6.22 have a severe XSS Reflection attack vulnerability. All unsanitized user input passed into renderPlaygroundPage() method could trigger this vulnerability. This has been patched in graphql-playground-html version 1.6.22. Note that some of the associated dependent middleware packages are also affected including but not limited to graphql-playground-middleware-express before version 1.7.16, graphql-playground-middleware-koa before version 1.6.15, graphql-playground-middleware-lambda before version 1.7.17, and graphql-playground-middleware-hapi before 1.6.13.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Prisma | Graphql-Playground-Html | < 1.6.22 |
| Prisma | Graphql-Playground-Middleware-Express | < 1.7.16 |
| Prisma | Graphql-Playground-Middleware-Hapi | < 1.6.13 |
| Prisma | Graphql-Playground-Middleware-Koa | < 1.6.15 |
| Prisma | Graphql-Playground-Middleware-Lambda | < 1.7.17 |
Related Weaknesses (CWE)
References
- https://github.com/prisma-labs/graphql-playground#security-detailsThird Party Advisory
- https://github.com/prisma-labs/graphql-playground/commit/bf1883db538c97b076801a6PatchThird Party Advisory
- https://github.com/prisma-labs/graphql-playground/security/advisories/GHSA-4852-MitigationThird Party Advisory
- https://github.com/prisma-labs/graphql-playground#security-detailsThird Party Advisory
- https://github.com/prisma-labs/graphql-playground/commit/bf1883db538c97b076801a6PatchThird Party Advisory
- https://github.com/prisma-labs/graphql-playground/security/advisories/GHSA-4852-MitigationThird Party Advisory
FAQ
What is CVE-2020-4038?
CVE-2020-4038 is a vulnerability with a CVSS score of 7.4 (HIGH). GraphQL Playground (graphql-playground-html NPM package) before version 1.6.22 have a severe XSS Reflection attack vulnerability. All unsanitized user input passed into renderPlaygroundPage() method c...
How severe is CVE-2020-4038?
CVE-2020-4038 has been rated HIGH with a CVSS base score of 7.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-4038?
Check the references section above for vendor advisories and patch information. Affected products include: Prisma Graphql-Playground-Html, Prisma Graphql-Playground-Middleware-Express, Prisma Graphql-Playground-Middleware-Hapi, Prisma Graphql-Playground-Middleware-Koa, Prisma Graphql-Playground-Middleware-Lambda.