{"id":"GO-2026-5837","summary":"DQL injection via checkUserPassword GraphQL query in github.com/dgraph-io/dgraph","details":"The checkUserPassword GraphQL query in Dgraph is vulnerable to Dgraph Query Language (DQL) injection. User-supplied password values are interpolated directly into a DQL checkpwd query without escaping or parameterization. An attacker can inject a password containing a double-quote character to break out of the DQL string literal and append arbitrary DQL query blocks.","aliases":["CVE-2026-44840","GHSA-q2m9-6jp9-c6mc"],"modified":"2026-07-23T17:45:22.622665040Z","published":"2026-07-07T15:26:32Z","database_specific":{"url":"https://pkg.go.dev/vuln/GO-2026-5837","review_status":"REVIEWED"},"references":[{"type":"ADVISORY","url":"https://github.com/dgraph-io/dgraph/security/advisories/GHSA-q2m9-6jp9-c6mc"},{"type":"FIX","url":"https://github.com/dgraph-io/dgraph/commit/cee702c93f141eeb0c96a81f70830ec9e459efac"},{"type":"WEB","url":"https://github.com/dgraph-io/dgraph/releases/tag/v25.3.4"}],"affected":[{"package":{"name":"github.com/dgraph-io/dgraph","ecosystem":"Go","purl":"pkg:golang/github.com/dgraph-io/dgraph"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"ecosystem_specific":{"imports":[{"path":"github.com/dgraph-io/dgraph"}]},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2026-5837.json"}},{"package":{"name":"github.com/hypermodeinc/dgraph/v24","ecosystem":"Go","purl":"pkg:golang/github.com/hypermodeinc/dgraph/v24"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"ecosystem_specific":{"imports":[{"path":"github.com/hypermodeinc/dgraph/v24"}]},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2026-5837.json"}},{"package":{"name":"github.com/dgraph-io/dgraph/v25","ecosystem":"Go","purl":"pkg:golang/github.com/dgraph-io/dgraph/v25"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"25.3.4"}]}],"ecosystem_specific":{"imports":[{"path":"github.com/dgraph-io/dgraph/v25"}]},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2026-5837.json"}}],"schema_version":"1.7.5"}