CVE-2020-4038
HIGHGraphQL Playground < 1.6.22 - Reflected Cross-Site Scripting via renderPlaygroundPage()
Title source: llmDescription
GraphQL Playground (graphql-playground-html NPM package) before version 1.6.22 have a severe XSS Reflection attack vulnerability. All unsanitized user input passed into renderPlaygroundPage() method could trigger this vulnerability. This has been patched in graphql-playground-html version 1.6.22. Note that some of the associated dependent middleware packages are also affected including but not limited to graphql-playground-middleware-express before version 1.7.16, graphql-playground-middleware-koa before version 1.6.15, graphql-playground-middleware-lambda before version 1.7.17, and graphql-playground-middleware-hapi before 1.6.13.
References (3)
Core 3
Core References
Mitigation, Third Party Advisory x_refsource_confirm
https://github.com/prisma-labs/graphql-playground/security/advisories/GHSA-4852-vrh7-28rf
Patch, Third Party Advisory x_refsource_misc
https://github.com/prisma-labs/graphql-playground/commit/bf1883db538c97b076801a60677733816cb3cfb7
Third Party Advisory x_refsource_misc
https://github.com/prisma-labs/graphql-playground#security-details
Scores
CVSS v3
7.4
EPSS
0.0724
EPSS Percentile
93.5%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N
Details
CWE
CWE-79
Status
published
Products (6)
npm/graphql-playground-html
0 - 1.6.22npm
prisma/graphql-playground-html
< 1.6.22
prisma/graphql-playground-middleware-express
< 1.7.16
prisma/graphql-playground-middleware-hapi
< 1.6.13
prisma/graphql-playground-middleware-koa
< 1.6.15
prisma/graphql-playground-middleware-lambda
< 1.7.17
Published
Jun 08, 2020
Tracked Since
Feb 18, 2026