Nixpkgs security tracker

Login with GitHub

Details of issue NIXPKGS-2026-2370

NIXPKGS-2026-2370
published 7 hours ago
Dgraph: DQL Injection via unvalidated regexp filter argument in GraphQL query rewriter
Permalink CVE-2026-63637
8.6 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): High (H)
  • Integrity (I): Low (L)
  • Availability (A): Low (L)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): Low (L)
  • Modified Availability (MA): Low (L)
updated 7 hours ago by @LeSuisse Activity log
  • Created suggestion 19 hours ago
  • @LeSuisse ignored
    3 packages
    • coqPackages.dpdgraph
    • perlPackages.GDGraph
    • perl5Packages.GDGraph
    8 hours ago
  • @LeSuisse accepted 8 hours ago
  • @LeSuisse published on GitHub 7 hours ago
Dgraph: DQL Injection via unvalidated regexp filter argument in GraphQL query rewriter

Dgraph is an open source distributed GraphQL database. Prior to 25.3.8, maybeQuoteArg in graphql/resolve/query_rewriter.go passes regexp filter strings into generated DQL without quoting or validating the /pattern/flags form, allowing crafted GraphQL query or mutation filters to inject DQL operators, disclose unintended nodes, or expand modification and deletion targets. This issue is fixed in version 25.3.8.

Affected products

dgraph
  • ==< 25.3.8

Matching in nixpkgs

Ignored packages (3)

Package maintainers