{"id":"CVE-2026-63397","summary":"remorses/genql code injection","details":"remorses/genql before version 6.3.4 allows an authenticated attacker with control of the GraphQL schema that is passed to genql to inject arbitrary JavaScript or TypeScript. The malicious code is injected into the generated schema.ts file and executes when the genql client is bundled and imported.","modified":"2026-07-23T03:56:31.431063758Z","published":"2026-07-16T19:14:30.532Z","database_specific":{"cna_assigner":"cisa-cg","cwe_ids":["CWE-116"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63397.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63397.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63397"},{"type":"ADVISORY","url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-197-01.json"},{"type":"ADVISORY","url":"https://www.cve.org/CVERecord?id=CVE-2026-63397"},{"type":"FIX","url":"https://github.com/remorses/genql/releases/tag/%40genql%2Fcli%406.3.4"},{"type":"PACKAGE","url":"https://github.com/remorses/genql"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/remorses/genql","events":[{"introduced":"0"},{"fixed":"5276a6968fd043cd2dab8270deadf3dc8ec9ec6b"}],"database_specific":{"source":["AFFECTED_FIELD","DESCRIPTION"],"extracted_events":[{"introduced":"0"},{"fixed":"6.3.4"}]}}],"versions":["@genql/cli@6.3.3","v2.10.0","v2.9.0","v2.8.0","v2.7.0","v2.6.0","v2.5.0","v2.4.0","v2.3.3","v2.3.2","v2.3.1","v2.3.0","v2.2.8","v2.2.7","v2.2.6","v2.2.5","v2.2.4","genql-runtime_1.1.28","genql-cli_1.1.28","genql-runtime_1.1.27","genql-cli_1.1.27","genql-runtime_1.1.26","genql-cli_1.1.26","genql-runtime_1.1.25","genql-cli_1.1.25","genql-runtime_1.1.24","genql-cli_1.1.24","genql-runtime_1.1.23","genql-cli_1.1.23","genql-runtime_1.1.22","genql-cli_1.1.22","genql-runtime_1.1.21","genql-cli_1.1.21","genql-runtime_1.1.20","genql-cli_1.1.20","genql-runtime_1.1.19","genql-cli_1.1.19","genql-runtime_1.1.18","genql-cli_1.1.18","genql-runtime_1.1.17","genql-cli_1.1.17","genql-runtime_1.1.16","genql-cli_1.1.16","genql-runtime_1.1.15","genql-cli_1.1.15","genql-runtime_1.1.14","genql-cli_1.1.14","genql-runtime_1.1.13","genql-cli_1.1.13","genql-runtime_1.1.12","genql-cli_1.1.12","genql-runtime_1.1.11","genql-cli_1.1.11","genql-runtime_1.1.10","genql-cli_1.1.10","genql-runtime_1.1.9","genql-cli_1.1.9","genql-cli_1.1.8","genql-runtime_1.1.8","genql-runtime_1.1.7","genql-cli_1.1.7","genql-runtime_1.1.6","genql-cli_1.1.6","genql-runtime_1.1.5","genql-cli_1.1.5","genql-runtime_1.1.4","genql-cli_1.1.4","genql-runtime_1.1.3","genql-cli_1.1.3","genql-runtime_1.1.2","genql-cli_1.1.2","genql-runtime_1.1.1","genql-cli_1.1.1","genql-runtime_1.0.59","genql-cli_1.0.58","genql-runtime_1.0.58","genql-cli_1.0.57","genql-runtime_1.0.57","genql-cli_1.0.56","genql-runtime_1.0.56","genql-cli_1.0.55","genql-runtime_1.0.55","genql-cli_1.0.54","genql-runtime_1.0.54","genql-cli_1.0.53","genql-runtime_1.0.53","genql-cli_1.0.52","genql-runtime_1.0.52","genql-cli_1.0.51","genql-runtime_1.0.51","genql-cli_1.0.50","genql-runtime_1.0.50","genql-cli_1.0.49","genql-runtime_1.0.49","genql-cli_1.0.48","genql-runtime_1.0.48","genql-cli_1.0.47","genql-runtime_1.0.47","genql-cli_1.0.46","genql-runtime_1.0.46","genql-cli_1.0.45","genql-runtime_1.0.45","genql-cli_1.0.44","genql-runtime_1.0.44","genql-cli_1.0.43","genql-runtime_1.0.43","genql-cli_1.0.42","genql-runtime_1.0.42","genql-runtime_1.0.41","genql-runtime_1.0.40","genql-runtime_1.0.39","genql-cli_1.0.41","genql-runtime_1.0.38","genql-cli_1.0.40","genql-runtime_1.0.37","genql-cli_1.0.39","genql-runtime_1.0.36","genql-cli_1.0.38","genql-runtime_1.0.35","genql-cli_1.0.37","genql-runtime_1.0.34","genql-cli_1.0.36","genql-runtime_1.0.33","genql-cli_1.0.35","genql-runtime_1.0.32","genql-cli_1.0.34","genql-runtime_1.0.31","genql-cli_1.0.33","genql-runtime_1.0.30","genql-cli_1.0.32","genql-runtime_1.0.29","genql-cli_1.0.31","genql-runtime_1.0.28","genql-cli_1.0.30","genql-runtime_1.0.26","genql-cli_1.0.28","genql-runtime_1.0.25","genql-cli_1.0.27","genql-runtime_1.0.24","genql-cli_1.0.26","genql-runtime_1.0.23","genql-cli_1.0.25","genql-runtime_1.0.22","genql-cli_1.0.24","genql-runtime_1.0.21","genql-cli_1.0.23","genql-runtime_1.0.20","genql-cli_1.0.22","genql-runtime_1.0.19","genql-cli_1.0.21","genql-runtime_1.0.18","genql-cli_1.0.20","genql-runtime_1.0.17","genql-cli_1.0.19","genql-cli_1.0.18","genql-runtime_1.0.16","genql-runtime_1.0.15","genql-cli_1.0.17","genql-runtime_1.0.14","genql-cli_1.0.16","genql-runtime_1.0.13","genql-cli_1.0.15","genql-runtime_1.0.12","genql-cli_1.0.14","genql-runtime_1.0.11","genql-cli_1.0.13","genql-runtime_1.0.10","genql-cli_1.0.12","genql-runtime_1.0.9","genql-cli_1.0.11","genql-runtime_1.0.8","genql-cli_1.0.10","genql-runtime_1.0.7","genql-cli_1.0.9","genql-runtime_1.0.6","genql-cli_1.0.8","genql-runtime_1.0.5","genql-cli_1.0.7","genql-runtime_1.0.4","genql-cli_1.0.6","genql-runtime_1.0.3","genql-cli_1.0.5","genql-runtime_1.0.2","genql-cli_1.0.4","genql-runtime_1.0.1","genql-cli_1.0.3","genql-cli_1.0.2","genql-cli_1.0.1","genql-cli_0.0.7","genql-cli_0.0.6","genql-cli_0.0.5","genql_0.0.4","genql_0.0.3","genql_0.0.2","genql-runtime_0.0.2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-63397.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}]}