{"cve":"CVE-2026-63397","nvd":{"published":"2026-07-16T20:16:47.950","modified":"2026-10-24T20:10:00.137","status":"Awaiting Analysis","description":"remorses/genql before version 6.3.4 allows an authenticated attacker with control of the GraphQL schema that is passed to genql to inject arbitrary JavaScript or TypeScript. The malicious code is injected into the generated schema.ts file and executes when the genql client is bundled and imported.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","score":7.1},"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","score":6.4},"cwes":["CWE-116"],"references":["https://github.com/remorses/genql","https://github.com/remorses/genql/releases/tag/%40genql%2Fcli%406.3.4","https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-197-01.json","https://www.cve.org/CVERecord?id=CVE-2026-63397"],"products":[],"source":"nvd","synced_at":"2026-10-25T17:50:08.599881581+00:00"},"epss":{"cve":"CVE-2026-63397","score":0.00477,"percentile":0.40913,"date":"2026-10-25"},"kev":null,"osv":[{"id":"GHSA-w757-xvvv-vgfw","url":"https://osv.dev/vulnerability/GHSA-w757-xvvv-vgfw","summary":"Genql: inject arbitrary JavaScript or TypeScript via a GraphQL schema","modified":"2026-08-13T18:51:16.259274Z","packages":[{"ecosystem":"npm","name":"@genql/cli","purl":"pkg:npm/%40genql/cli","ranges":["<6.3.4"],"fixed":["6.3.4"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}