CVE-2026-63637

Name of the Vulnerable Software and Affected Versions Dgraph versions prior to 25.3.8

Description The maybeQuoteArg function in graphql/resolve/query rewriter.go fails to quote or validate the /pattern/flags form when passing regexp filter strings into generated DQL (Dgraph Query Language). This allows an attacker to use crafted GraphQL query or mutation filters to inject DQL operators, which can lead to the disclosure of unintended nodes or the expansion of targets for modification and deletion.

Recommendations Update to version 25.3.8.