Insecure Default Configuration in graphql-code-generator
Summary
GHSA-9w87-4j72-gcv7: Insecure Default Configuration in graphql-code-generator. Affects graphql-code-generator versions < 0.18.2. Fixed in 0.18.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The graphql-code-generator package is an open-source tool that generates code based on GraphQL schemas and operations. It is commonly used in JavaScript and TypeScript projects to automate the creation of types, resolvers, and other boilerplate code. This package is available on the npm registry and can be easily installed and integrated into projects.
Vulnerability Detail
Versions of graphql-code-generator prior to 0.18.2 have an insecure default configuration. The package sets NODE_TLS_REJECT_UNAUTHORIZED to 0, which disables certificate verification for the entire project. This means that the process using graphql-code-generator may establish insecure communication channels without verifying the authenticity of the server's SSL/TLS certificate. This vulnerability exposes the project to potential man-in-the-middle attacks and data interception.
How To Fix
Minimum fixed version
0.18.2
This is the first release that contains the fix.
npm install graphql-code-generator@0.18.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
Insecure Default Configuration in graphql-code-generator exposes projects to potential man-in-the-middle attacks and data interception. It is crucial to upgrade to version 0.18.2 or later to fix this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for graphql-code-generator →
FAQ
graphql-code-generator is a tool used to automatically generate code based on GraphQL schemas and operations. It helps reduce boilerplate code and improves developer productivity.
The vulnerability allows for insecure communication channels to be established without verifying the server's SSL/TLS certificate. This exposes the project to potential man-in-the-middle attacks and data interception.
You can check the version of graphql-code-generator installed in your project by running the following command in the project's root directory: npm list graphql-code-generator
No, there are no known workarounds for this vulnerability. It is recommended to upgrade to the fixed version of graphql-code-generator.
You can find more information about this vulnerability in the GitHub Advisory Database: [link to advisory]
