Cross-site Scripting Vulnerability in Apollo Server
Summary
GHSA-qm7x-rc44-rrqw: Cross-site Scripting Vulnerability in GraphQL Playground (distributed by Apollo Server). Affects apollo-server across 2 version ranges.
>= 2.0.0, < 2.25.3
>= 3.0.0, < 3.4.1
Fixed in 2.25.3 or 3.4.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apollo Server is an open-source GraphQL server that allows developers to build scalable and efficient GraphQL APIs. It is widely used in various JavaScript ecosystems, including Node.js and Express. However, certain configurations of Apollo Server can serve the client-side web app 'GraphQL Playground' from the same web server that executes GraphQL operations. This web app has access to cookies and other credentials associated with the web server's operations, making it vulnerable to cross-site scripting attacks.
Vulnerability Detail
The vulnerability in Apollo Server allows for arbitrary JavaScript code execution in the web server's origin. If a user clicks a specially crafted link to the GraphQL Playground page served by Apollo Server, an attacker can steal cookies and other private browser data. This vulnerability can have severe consequences if the GraphQL server's origin URL is used to store sensitive data such as cookies. The vulnerability is caused by a cross-site scripting vulnerability in GraphQL Playground itself, which is detailed in the 'graphql-playground' advisory.
How To Fix
Latest published version: 3.13.0 as of 23 Oct 2026
npm install apollo-server@3.13.0Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 2.0.0, < 2.25.32.25.3npm install apollo-server@2.25.3 -
>= 3.0.0, < 3.4.13.4.1npm install apollo-server@3.4.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to the latest version of Apollo Server is challenging, a workaround is to configure the current version of Apollo Server to serve the latest version of the GraphQL Playground app. This can be done by specifying the 'version' option when configuring GraphQL Playground. The specific steps depend on the version of Apollo Server being used and the current configuration of GraphQL Playground.
Conclusion
The cross-site scripting vulnerability in Apollo Server can have severe consequences, allowing attackers to steal sensitive information from users. It is crucial to upgrade to the latest version of Apollo Server or apply the recommended workaround to mitigate the vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for apollo-server →
FAQ
Apollo Server is an open-source GraphQL server that allows developers to build scalable and efficient GraphQL APIs. It is widely used in various JavaScript ecosystems, including Node.js and Express.
GraphQL Playground is a client-side web app that provides a graphical interface for exploring and testing GraphQL APIs. It is often served by Apollo Server and has access to cookies and other credentials associated with the web server's operations.
The vulnerability occurs when Apollo Server serves GraphQL Playground from the same web server that executes GraphQL operations. This allows for a cross-site scripting vulnerability in GraphQL Playground, which can lead to arbitrary JavaScript code execution in the web server's origin.
The vulnerability allows an attacker to steal cookies and other private browser data from users who click on specially crafted links to the GraphQL Playground page served by Apollo Server. This can lead to unauthorized access to sensitive information and potential account hijacking.
To fix the vulnerability, it is recommended to upgrade to the latest version of Apollo Server. Upgrade the Apollo Server entry point package to one of the fixed versions, such as 'apollo-server', 'apollo-server-express', or 'apollo-server-lambda'. Additionally, if 'apollo-server-core' is directly depended upon in the 'package.json' file, make sure to upgrade it to the same version.
References
Related vulnerabilities
Recent vulnerabilities recorded for apollo-server.
