Authenticated JavaScript Injection in GenQL Code Generator

Executive Summary

This vulnerability is a code injection flaw in the remorses/genql library before version 6.3.4. An authenticated attacker with control over the GraphQL schema can inject arbitrary JavaScript or TypeScript code into the generated schema.ts file. This malicious code executes when the genql client is bundled and imported by the victim.

Useful 0 Not Useful 0

Detection Guidance

Check if your system uses @genql/cli versions before 6.3.4 by inspecting package.json or running npm list @genql/cli. Look for generated schema.ts files containing suspicious TypeScript code or JSDoc comments with unescaped '*/' sequences.

Useful 0 Not Useful 0

Impact Analysis

If you use an affected version of genql and process schemas from untrusted sources, an attacker could inject malicious code that runs in your application. This could lead to data theft, unauthorized actions, or further compromise of your system depending on the privileges of the application.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized code execution, potentially exposing sensitive data. For GDPR, this may result in violations of data protection principles if personal data is accessed or exfiltrated. For HIPAA, it could compromise protected health information if healthcare systems are affected. Compliance may be impacted if the vulnerability enables data breaches or unauthorized access to regulated data.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade @genql/cli to version 6.3.4 or later. If using untrusted GraphQL schemas, sanitize descriptions by escaping '*/' to '*\/' before passing them to generate(). Review generated schema.ts files for unexpected code injections.

Useful 0 Not Useful 0