{"id":"CVE-2024-24556","summary":"XSS in @urql/next","details":"urql is a GraphQL client that exposes a set of helpers for several frameworks.  The `@urql/next` package is vulnerable to XSS. To exploit this an attacker would need to ensure that the response returns `html` tags and that the web-application is using streamed responses (non-RSC). This vulnerability is due to improper escaping of html-like characters in the response-stream. To fix this vulnerability upgrade to version 1.1.1","aliases":["GHSA-qhjf-hm5j-335w"],"modified":"2026-08-12T03:51:21.646333539Z","published":"2024-01-30T17:21:19.964Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/24xxx/CVE-2024-24556.json","cna_assigner":"GitHub_M","cwe_ids":["CWE-79"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/24xxx/CVE-2024-24556.json"},{"type":"ADVISORY","url":"https://github.com/urql-graphql/urql/security/advisories/GHSA-qhjf-hm5j-335w"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-24556"},{"type":"FIX","url":"https://github.com/urql-graphql/urql/commit/4b7011b70d5718728ff912d02a4dbdc7f703540d"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/urql-graphql/urql","events":[{"introduced":"0"},{"fixed":"bc09338d13db9d512665e47809b9d6554da4b7ac"},{"fixed":"4b7011b70d5718728ff912d02a4dbdc7f703540d"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"1.1.1"}],"source":["CPE_RANGE","REFERENCES"],"cpe":"cpe:2.3:a:nearform:urql:*:*:*:*:*:node.js:*:*"}}],"versions":["@urql/storage-rn@1.1.0","@urql/introspection@1.0.3","@urql/exchange-retry@1.2.1","@urql/core@4.2.3","@urql/core@4.2.2","@urql/core@4.2.1","@urql/exchange-persisted@4.1.1","@urql/exchange-graphcache@6.4.0","urql@4.0.6","@urql/preact@4.0.4","@urql/core@4.2.0","@urql/next@1.1.0","@urql/core@4.1.4","@urql/core@4.1.3","@urql/exchange-graphcache@6.3.3","@urql/core@4.1.2","@urql/exchange-graphcache@6.3.2","@urql/exchange-auth@2.1.6","@urql/core@4.1.1","@urql/exchange-graphcache@6.3.1","@urql/svelte@4.0.4","@urql/exchange-graphcache@6.3.0","urql@4.0.5","@urql/next@1.0.0","@urql/exchange-persisted@4.1.0","@urql/exchange-graphcache@6.2.0","@urql/core@4.1.0","@urql/svelte@4.0.3","@urql/exchange-persisted@4.0.1","@urql/exchange-auth@2.1.5","@urql/core@4.0.11","@urql/exchange-graphcache@6.1.4","@urql/exchange-graphcache@6.1.3","urql@4.0.4","next-urql@5.0.2","@urql/storage-rn@1.0.3","@urql/preact@4.0.3","@urql/exchange-graphcache@6.1.2","@urql/core@4.0.10","@urql/core@4.0.9","@urql/exchange-graphcache@6.1.1","@urql/exchange-auth@2.1.4","urql@4.0.3","@urql/vue@1.1.2","@urql/svelte@4.0.2","@urql/preact@4.0.2","@urql/exchange-retry@1.2.0","@urql/exchange-graphcache@6.1.0","@urql/exchange-execute@2.2.2","@urql/exchange-auth@2.1.3","@urql/core@4.0.8","urql@4.0.2","@urql/exchange-persisted@4.0.0","@urql/exchange-graphcache@6.0.4","urql@4.0.1","next-urql@5.0.1","@urql/vue@1.1.1","@urql/svelte@4.0.1","@urql/storage-rn@1.0.2","@urql/preact@4.0.1","@urql/introspection@1.0.2","@urql/exchange-retry@1.1.1","@urql/exchange-request-policy@1.0.2","@urql/exchange-refocus@1.0.2","@urql/exchange-populate@1.1.2","@urql/exchange-persisted@3.0.1","@urql/exchange-graphcache@6.0.3","@urql/exchange-execute@2.2.1","@urql/exchange-context@0.2.1","@urql/exchange-auth@2.1.2","@urql/core@4.0.7","@urql/core@4.0.6","@urql/exchange-graphcache@6.0.2","@urql/exchange-auth@2.1.1","@urql/core@4.0.5","@urql/core@4.0.4","@urql/core@4.0.3","@urql/core@4.0.2","@urql/core@4.0.1","@urql/exchange-graphcache@6.0.1","urql@4.0.0","next-urql@5.0.0","@urql/vue@1.1.0","@urql/svelte@4.0.0","@urql/storage-rn@1.0.1","@urql/preact@4.0.0","@urql/introspection@1.0.1","@urql/exchange-retry@1.1.0","@urql/exchange-request-policy@1.0.1","@urql/exchange-refocus@1.0.1","@urql/exchange-populate@1.1.1","@urql/exchange-persisted@3.0.0","@urql/exchange-multipart-fetch@1.1.0","@urql/exchange-graphcache@6.0.0","@urql/exchange-execute@2.2.0","@urql/exchange-context@0.2.0","@urql/exchange-auth@2.1.0","@urql/core@4.0.0","@urql/core@3.2.2","@urql/core@3.2.1","urql@3.0.4","@urql/vue@1.0.5","@urql/svelte@3.0.4","@urql/preact@3.0.3","@urql/exchange-populate@1.1.0","@urql/exchange-graphcache@5.2.0","@urql/exchange-auth@2.0.0","next-urql@4.0.3","@urql/exchange-persisted-fetch@2.1.0","@urql/exchange-graphcache@5.0.9","@urql/exchange-graphcache@5.0.8","next-urql@4.0.2","@urql/vue@1.0.4","@urql/svelte@3.0.3","@urql/exchange-graphcache@5.0.7","@urql/exchange-execute@2.1.1","@urql/core@3.1.1","next-urql@4.0.1","@urql/vue@1.0.3","@urql/svelte@3.0.2","@urql/exchange-graphcache@5.0.6","@urql/exchange-execute@2.1.0","@urql/core@3.1.0","@urql/exchange-graphcache@5.0.5","@urql/exchange-graphcache@5.0.4","@urql/exchange-graphcache@5.0.3","@urql/core@3.0.5","@urql/exchange-graphcache@5.0.2","@urql/core@3.0.4","urql@3.0.3","urql@3.0.2","@urql/preact@3.0.2","@urql/core@3.0.3","@urql/storybook-addon@2.0.1","@urql/exchange-multipart-fetch@1.0.1","@urql/exchange-graphcache@5.0.1","@urql/core@3.0.2","@urql/core@3.0.1","@urql/vue@1.0.2","urql@3.0.1","@urql/vue@1.0.1","@urql/svelte@3.0.1","@urql/preact@3.0.1","urql@3.0.0","next-urql@4.0.0","@urql/vue@1.0.0","@urql/svelte@3.0.0","@urql/storybook-addon@2.0.0","@urql/storage-rn@1.0.0","@urql/preact@3.0.0","@urql/introspection@1.0.0","@urql/exchange-retry@1.0.0","@urql/exchange-request-policy@1.0.0","@urql/exchange-refocus@1.0.0","@urql/exchange-populate@1.0.0","@urql/exchange-persisted-fetch@2.0.0","@urql/exchange-multipart-fetch@1.0.0","@urql/exchange-graphcache@5.0.0","@urql/exchange-execute@2.0.0","@urql/exchange-context@0.1.0","@urql/exchange-auth@1.0.0","@urql/core@3.0.0","@urql/vue@0.6.4","urql@2.2.3","@urql/core@2.6.1","@urql/core@2.6.0","@urql/introspection@0.3.3","@urql/svelte@2.0.2","urql@2.2.2","next-urql@3.3.3","@urql/vue@0.6.3","@urql/svelte@2.0.1","@urql/storybook-addon@1.0.9","@urql/preact@2.0.4","@urql/exchange-graphcache@4.4.3","urql@2.2.1","@urql/exchange-graphcache@4.4.2","@urql/svelte@2.0.0","@urql/exchange-graphcache@4.4.1","@urql/core@2.5.0","@urql/exchange-graphcache@4.4.0","@urql/exchange-execute@1.2.3","@urql/vue@0.6.2","@urql/exchange-retry@0.3.3","@urql/core@2.4.4","urql@2.2.0","@urql/core@2.4.3","@urql/introspection@0.3.2","@urql/core@2.4.2","urql@2.1.3","urql@2.1.2","@urql/core@2.4.1","urql@2.1.1","urql@2.1.0","@urql/storage-rn@0.1.1","@urql/core@2.4.0","@urql/exchange-execute@1.2.2","urql@2.0.6","next-urql@3.3.2","@urql/vue@0.6.1","@urql/svelte@1.3.3","@urql/storybook-addon@1.0.8","@urql/preact@2.0.3","@urql/introspection@0.3.1","@urql/exchange-retry@0.3.2","@urql/exchange-request-policy@0.1.5","@urql/exchange-refocus@0.2.5","@urql/exchange-populate@0.2.3","@urql/exchange-persisted-fetch@1.3.4","@urql/exchange-multipart-fetch@0.1.14","@urql/exchange-graphcache@4.3.6","@urql/exchange-execute@1.2.1","@urql/exchange-auth@0.1.7","@urql/core@2.3.6","@urql/exchange-retry@0.3.1","@urql/exchange-refocus@0.2.4","@urql/exchange-persisted-fetch@1.3.3","next-urql@3.3.1","next-urql@3.3.0","@urql/exchange-execute@1.2.0","@urql/core@2.3.5","@urql/vue@0.6.0","@urql/svelte@1.3.2","@urql/core@2.3.4","@urql/storage-rn@0.1.0","@urql/exchange-graphcache@4.3.5","@urql/core@2.3.3","urql@2.0.5","@urql/vue@0.5.0","@urql/svelte@1.3.1","@urql/exchange-graphcache@4.3.4","@urql/core@2.3.2","@urql/exchange-graphcache@4.3.3","next-urql@3.2.1","@urql/exchange-graphcache@4.3.2","@urql/exchange-retry@0.3.0","@urql/exchange-graphcache@4.3.1","@urql/core@2.3.1","@urql/exchange-graphcache@4.3.0","@urql/exchange-execute@1.1.0","@urql/core@2.3.0","next-urql@3.2.0","@urql/exchange-auth@0.1.6","@urql/core@2.2.0","@urql/exchange-execute@1.0.5","@urql/exchange-auth@0.1.5","@urql/core@2.1.6","@urql/vue@0.4.3","@urql/exchange-multipart-fetch@0.1.13","@urql/exchange-auth@0.1.4","@urql/exchange-graphcache@4.2.1","next-urql@3.1.1","@urql/vue@0.4.2","@urql/svelte@1.3.0","@urql/exchange-request-policy@0.1.4","@urql/exchange-persisted-fetch@1.3.2","@urql/exchange-graphcache@4.2.0","@urql/core@2.1.5","urql@2.0.4","@urql/vue@0.4.1","@urql/svelte@1.2.3","@urql/exchange-graphcache@4.1.4","@urql/core@2.1.4","@urql/exchange-graphcache@4.1.3","@urql/core@2.1.3","@urql/exchange-graphcache@4.1.2","@urql/exchange-request-policy@0.1.3","@urql/core@2.1.2","@urql/exchange-graphcache@4.1.1","@urql/core@2.1.1","urql@2.0.3","next-urql@3.1.0","@urql/vue@0.4.0","@urql/svelte@1.2.2","@urql/storybook-addon@1.0.7","@urql/preact@2.0.2","@urql/introspection@0.3.0","@urql/exchange-retry@0.2.1","@urql/exchange-request-policy@0.1.2","@urql/exchange-refocus@0.2.3","@urql/exchange-populate@0.2.2","@urql/exchange-persisted-fetch@1.3.1","@urql/exchange-multipart-fetch@0.1.12","@urql/exchange-graphcache@4.1.0","@urql/exchange-execute@1.0.4","@urql/exchange-auth@0.1.3","@urql/core@2.1.0","urql@2.0.2","next-urql@3.0.1","@urql/svelte@1.2.1","@urql/storybook-addon@1.0.6","@urql/preact@2.0.1","@urql/exchange-refocus@0.2.2","urql@2.0.1","urql@2.0.0","next-urql@3.0.0","@urql/vue@0.3.0","@urql/svelte@1.2.0","@urql/preact@2.0.0","@urql/introspection@0.2.0","@urql/exchange-request-policy@0.1.1","@urql/exchange-persisted-fetch@1.3.0","@urql/exchange-graphcache@4.0.0","@urql/core@2.0.0","@urql/core@1.16.2","urql@1.11.6","next-urql@2.2.0","@urql/exchange-graphcache@3.4.0","urql@1.11.5","@urql/preact@1.4.4","@urql/exchange-graphcache@3.3.4","@urql/exchange-graphcache@3.3.3","@urql/core@1.16.1","@urql/exchange-graphcache@3.3.2","@urql/introspection@0.1.2","@urql/exchange-graphcache@3.3.1","urql@1.11.4","@urql/vue@0.2.1","@urql/svelte@1.1.4","@urql/preact@1.4.3","@urql/exchange-graphcache@3.3.0","@urql/core@1.16.0","@urql/exchange-graphcache@3.2.0","@urql/core@1.15.2","urql@1.11.3","@urql/vue@0.2.0","@urql/vue@0.1.0","urql@1.11.2","@urql/storybook-addon@1.0.5","@urql/preact@1.4.2","urql@1.11.1","@urql/preact@1.4.1","@urql/exchange-execute@1.0.3","@urql/core@1.15.1","urql@1.11.0","@urql/svelte@1.1.3","@urql/storybook-addon@1.0.4","@urql/preact@1.4.0","@urql/exchange-retry@0.2.0","@urql/exchange-graphcache@3.1.11","@urql/core@1.15.0","@urql/exchange-graphcache@3.1.10","next-urql@2.1.1","urql@1.10.3","@urql/preact@1.3.2","@urql/exchange-retry@0.1.10","@urql/exchange-persisted-fetch@1.2.3","@urql/exchange-multipart-fetch@0.1.11","@urql/exchange-graphcache@3.1.9","@urql/core@1.14.1","urql@1.10.2","next-urql@2.1.0","@urql/preact@1.3.1","@urql/introspection@0.1.1","@urql/exchange-suspense@1.9.2","@urql/exchange-retry@0.1.9","@urql/exchange-refocus@0.2.1","@urql/exchange-populate@0.2.1","@urql/exchange-persisted-fetch@1.2.2","@urql/exchange-multipart-fetch@0.1.10","@urql/exchange-graphcache@3.1.8","@urql/exchange-execute@1.0.2","@urql/exchange-auth@0.1.2","@urql/core@1.14.0","@urql/exchange-refocus@0.2.0","@urql/exchange-graphcache@3.1.7","@urql/exchange-graphcache@3.1.6","@urql/exchange-auth@0.1.1","@urql/exchange-graphcache@3.1.5","@urql/svelte@1.1.2","@urql/svelte@1.1.1","@urql/svelte@1.1.0","@urql/svelte@1.0.1","@urql/exchange-graphcache@3.1.4","next-urql@2.0.0","@urql/svelte@1.0.0","@urql/exchange-graphcache@3.1.3","next-urql@1.2.0","@urql/preact@1.3.0","@urql/exchange-refocus@0.1.0","@urql/exchange-populate@0.2.0","@urql/exchange-graphcache@3.1.2","@urql/core@1.13.1","@urql/storybook-addon@1.0.3","@urql/exchange-graphcache@3.1.1","@urql/introspection@0.1.0","urql@1.10.1","@urql/preact@1.2.1","@urql/exchange-persisted-fetch@1.2.1","@urql/exchange-multipart-fetch@0.1.9","@urql/exchange-graphcache@3.1.0","@urql/exchange-auth@0.1.0","@urql/core@1.13.0","urql@1.10.0","next-urql@1.1.0","@urql/svelte@0.4.0","@urql/preact@1.2.0","@urql/exchange-request-policy@0.1.0","@urql/exchange-persisted-fetch@1.2.0","@urql/exchange-graphcache@3.0.2","@urql/core@1.12.3","next-urql@1.0.2","@urql/exchange-persisted-fetch@1.1.0","@urql/core@1.12.2","next-urql@1.0.1","@urql/svelte@0.3.0","@urql/exchange-graphcache@3.0.1","@urql/core@1.12.1","urql@1.9.8","next-urql@1.0.0","@urql/svelte@0.2.4","@urql/preact@1.1.8","@urql/exchange-suspense@1.9.1","@urql/exchange-retry@0.1.8","@urql/exchange-populate@0.1.8","@urql/exchange-persisted-fetch@1.0.1","@urql/exchange-multipart-fetch@0.1.8","@urql/exchange-graphcache@3.0.0","@urql/exchange-execute@1.0.1","@urql/core@1.12.0","next-urql@0.3.8","@urql/exchange-persisted-fetch@1.0.0","@urql/core@1.11.8","@urql/exchange-suspense@1.9.0","@urql/exchange-execute@1.0.0","@urql/exchange-suspense@1.8.9","@urql/exchange-retry@0.1.7","@urql/exchange-persisted-fetch@0.1.3","@urql/exchange-multipart-fetch@0.1.7","@urql/exchange-graphcache@2.4.2","@urql/core@1.11.7","@urql/svelte@0.2.3","@urql/preact@1.1.7","@urql/exchange-retry@0.1.6","@urql/exchange-populate@0.1.7","@urql/exchange-persisted-fetch@0.1.2","@urql/exchange-multipart-fetch@0.1.6","@urql/exchange-graphcache@2.4.1","@urql/core@1.11.6","@urql/exchange-persisted-fetch@0.1.1","@urql/svelte@0.2.2","@urql/exchange-graphcache@2.4.0","@urql/exchange-persisted-fetch@0.1.0","@urql/core@1.11.5","@urql/exchange-graphcache@2.3.8","@urql/core@1.11.4","@urql/core@1.11.1","@urql/exchange-graphcache@2.3.5","urql@1.9.7","@urql/svelte@0.2.1","@urql/preact@1.1.6","next-urql@0.3.7","@urql/exchange-retry@0.1.5","@urql/exchange-multipart-fetch@0.1.5","@urql/exchange-graphcache@2.3.4","@urql/core@1.11.0","@urql/svelte@0.2.0","@urql/exchange-populate@0.1.6","@urql/exchange-graphcache@2.3.3","@urql/exchange-populate@0.1.5","@urql/exchange-graphcache@2.3.2","@urql/core@1.10.9","urql@1.9.6","@urql/svelte@0.1.3","@urql/preact@1.1.5","@urql/exchange-suspense@1.8.8","@urql/exchange-retry@0.1.4","@urql/exchange-populate@0.1.4","@urql/exchange-multipart-fetch@0.1.4","@urql/exchange-graphcache@2.3.1","@urql/core@1.10.8","@urql/core@1.10.7","@urql/core@1.10.6","urql@1.9.5","@urql/exchange-graphcache@2.3.0","@urql/core@1.10.5","urql@1.9.4","next-urql@0.3.6","urql@1.9.3","next-urql@0.3.5","@urql/svelte@0.1.2","@urql/preact@1.1.4","@urql/exchange-suspense@1.8.7","@urql/exchange-retry@0.1.3","@urql/exchange-populate@0.1.3","@urql/exchange-multipart-fetch@0.1.3","@urql/exchange-graphcache@2.2.8","@urql/core@1.10.4","urql@1.9.2","next-urql@0.3.4","@urql/svelte@0.1.1","@urql/preact@1.1.3","@urql/exchange-suspense@1.8.6","@urql/exchange-retry@0.1.2","@urql/exchange-populate@0.1.2","@urql/exchange-multipart-fetch@0.1.2","@urql/exchange-graphcache@2.2.7","@urql/core@1.10.3","urql@1.9.1","@urql/svelte@0.1.0","@urql/preact@1.1.2","@urql/exchange-graphcache@2.2.6","@urql/core@1.10.2","@urql/exchange-graphcache@2.2.5","next-urql@0.3.3","@urql/exchange-suspense@1.8.5","@urql/exchange-retry@0.1.1","@urql/exchange-multipart-fetch@0.1.1","@urql/exchange-graphcache@2.2.4","@urql/core@1.10.1","next-urql@0.3.2","@urql/exchange-suspense@1.8.4","@urql/exchange-retry@0.1.0","@urql/exchange-multipart-fetch@0.1.0","@urql/exchange-graphcache@2.2.3","@urql/core@1.10.0","@urql/exchange-graphcache@2.2.2","@urql/exchange-populate@0.1.1","@urql/exchange-graphcache@2.2.1","@urql/core@1.9.2","next-urql@0.3.1","@urql/svelte@0.1.0-alpha.0","@urql/exchange-populate@0.1.0","@urql/exchange-graphcache@2.2.0","@urql/core@1.9.1","urql@1.9.0","@urql/preact@1.1.1","@urql/exchange-suspense@1.8.3","@urql/exchange-graphcache@2.1.1","@urql/core@1.9.0","v1.8.2","v1.8.1","v1.8.0","v1.7.0","v1.6.3","v1.6.2","v1.6.1","v1.6.0","v1.5.1","v1.5.0","v1.4.1","v1.4.0","v1.3.0","v1.2.0","v1.1.3","v1.1.2","v1.1.1","v1.1.0","v1.0.5","v1.0.4","v1.0.3","v1.0.2","v1.0.1","v1.0.0","v0.3.0-next1","v0.2.1","v0.2.0","v0.1.1","v0.1.0","v0.0.11","v0.0.10","v0.0.9","v0.0.8","v0.0.7","v0.0.6","v0.0.5","v0.0.4","v0.0.3","v0.0.2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-24556.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"}]}