Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

graphql/graphiql

              main @ d8d6dad
            

Fixes

CVEs

HIGH

Peak severity

35.3%

Coverage

Highlights

Denial of Service: 12 prior fixes. Scrutinize any change in this area.

graphql-language-service-server: most-fixed (5 issues). Treat as high-risk during review.

4 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Reflected XSS: Malicious GraphQL schema type names can trigger arbitrary script execution within the operation autocomplete list due to unescaped rendering into innerHTML. This is tracked under CVE-2021-41248.

Stored XSS: Rendering GraphQL schema descriptions as Markdown via dangerouslySetInnerHTML without proper sanitization allows attackers to inject malicious code permanently into the documentation explorer UI.

Denial of Service: The GraphQL language service parser can enter an infinite loop and hang when encountering non-breaking whitespace characters due to insufficient loop progress validation in isIgnored.