CVSS 3.1
6.1 mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NCVE-2024-23841
Medium (6.1) in apollographql apollo client. EPSS 0.4% chance of exploitation in the next 30 days. Fixed in @apollo/experimental-nextjs-app-support 0.7.0.
apollo-client-nextjs is the Apollo Client support for the Next.js App Router. The @apollo/experimental-apollo-client-nextjs NPM package is vulnerable to a cross-site scripting vulnerability. To exploit this vulnerability, an attacker would need to either inject malicious input (e.g. by redirecting a user to a specifically-crafted link) or arrange to have malicious input be returned by a GraphQL server (e.g. by persisting it in a database). To fix this issue, please update to version 0.7.0 or later.
Severity
- EPSS
- 0.4% chance of exploitation in the next 30 days; higher than 32% of CVEs (scores of 2026-10-31)
- CWE
- CWE-80
- Published
- Modified
- Record from
- the NVD, synced
Affected
- apollographql:apollo_client
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-rv8p-rr2h-fgpg | npm | @apollo/experimental-nextjs-app-support | <0.7.0 | 0.7.0 |
References
- https://github.com/apollographql/apollo-client-nextjs/commit/b92bc42abd5f8e17d4db361c36bd08e4f541a46b
- https://github.com/apollographql/apollo-client-nextjs/security/advisories/GHSA-rv8p-rr2h-fgpg
- https://github.com/apollographql/apollo-client-nextjs/commit/b92bc42abd5f8e17d4db361c36bd08e4f541a46b
- https://github.com/apollographql/apollo-client-nextjs/security/advisories/GHSA-rv8p-rr2h-fgpg