PT-2026-60570

CVE-2026-63397

Published

2026-07-16

Updated

2026-10-24

Description by

CVSS 4.0

7.1

High

MetricsAV:N/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions genql versions prior to 6.3.4

Description An authenticated attacker who can control the GraphQL schema passed to genql can inject arbitrary JavaScript or TypeScript. This malicious code is inserted into the generated schema.ts file and is executed when the genql client is bundled and imported.

Recommendations Update to version 6.3.4 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-116: Improper Encoding or Escaping of Output

Related identifiers

CVE-2026-63397