CVE-2026-63397 | remorses/genql before version 6.3.4 allows an authenticated … | CVSS 6.4 MEDIUM

Description

remorses/genql before version 6.3.4 allows an authenticated attacker with control of the GraphQL schema that is passed to genql to inject arbitrary JavaScript or TypeScript. The malicious code is injected into the generated schema.ts file and executes when the genql client is bundled and imported.

Metadata

CVE ID: CVE-2026-63397
State: PUBLISHED
Assigner: cisa-cg
Reserved: 2026-07-16 18:33 UTC
Published: 2026-07-16 19:14 UTC
Last updated: 2026-07-16 19:14 UTC
Primary CWE: CWE-116
CWE-116 Improper Encoding or Escaping of Output
Vendor / Product: remorses / genql
Sources: cve.org · NVD

Severity & Metrics

6.4 MEDIUM CVSS 3.1

CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H

Affected products (1)

Vendor	Product	Platform	Versions
remorses	genql	—	0 < 6.3.4, 6.3.4

Weakness (CWE)

CWE	Source	Description
CWE-116	cna	CWE-116 Improper Encoding or Escaping of Output

CVSS scores (2)

Score	Severity	Version	Source	Vector
7.1	HIGH	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
6.4	MEDIUM	3.1	cna	CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H

References (4)