CVE-2021-41248: GraphiQL Introspection Schema Template Injection Attack
Summary
CVE-2021-41248: GraphiQL introspection schema template injection attack. Affects graphiql versions >= 0.5.0, < 1.4.7. Fixed in 1.4.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GraphiQL is an open-source interactive development environment for GraphQL. It provides a user-friendly interface for exploring and testing GraphQL APIs. The vulnerability affects all versions of GraphiQL prior to 1.4.7. It allows for compromised HTTP schema introspection responses or schema prop values with malicious GraphQL type names, leading to a dynamic XSS attack surface. This can enable code injection on operation autocomplete. The vulnerability can be exploited if a user loads a vulnerable schema in GraphiQL, which can occur through complex attack vectors or custom implementations that allow the schema URL to be set dynamically. The impact of this vulnerability is the potential exfiltration of user credentials and data through arbitrary malicious scripts.
Vulnerability Detail
The vulnerability in GraphiQL arises from a lack of proper HTML-escaping of text and inadequate schema validation. By escaping text that should be treated as text rather than HTML, the known vulnerability is fixed. Additionally, validating the schema upon receiving introspection responses or schema changes prevents the loading of schemas with names that violate the GraphQL spec. This validation also fixes the known vulnerability. The web app also ensures that user-generated HTML is safe by using the markdown-it library without enabling HTML rendering. The vulnerability affects all versions of GraphiQL and its forks, including GraphQL Playground and the GraphQL Playground fork distributed by Apollo Server.
How To Fix
Latest published version: 5.4.0 as of 22 Oct 2026
npm install graphiql@5.4.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.4.7
This is the first release that contains the fix.
npm install graphiql@1.4.7Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating GraphiQL is not feasible, the following workarounds can be implemented:
- Always use a static URL to a trusted server that serves a trusted GraphQL schema.
- If using a custom implementation that allows user-provided schema URLs, either disable this customization or only allow trusted URLs.
Conclusion
The vulnerability in GraphiQL can lead to a dynamic XSS attack surface, enabling code injection on operation autocomplete. It is crucial to update GraphiQL to version 1.4.7 or later to mitigate this vulnerability. If updating is not feasible, implementing the recommended workarounds can help protect against potential attacks. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for graphiql →
FAQ
GraphiQL is an open-source interactive development environment for GraphQL. It provides a user-friendly interface for exploring and testing GraphQL APIs.
All versions of GraphiQL prior to 1.4.7 are vulnerable to this XSS attack.
The vulnerability can be exploited by loading a vulnerable schema in GraphiQL. This can occur through complex attack vectors or custom implementations that allow the schema URL to be set dynamically.
The vulnerability exposes an XSS attack surface, allowing a threat actor to execute arbitrary malicious scripts. This can lead to the exfiltration of user credentials and data without the user's knowledge.
Yes, if updating GraphiQL is not possible, it is recommended to use a static URL to a trusted server that serves a trusted GraphQL schema. If using a custom implementation, either disable the customization or only allow trusted URLs.
