Skip to content
fr Sign in
8.1 High

CVE-2026-59286 The GraphiQL page bundled with Spring for GraphQL loads JavaScript libraries from a public CDN, without Subresource…

Description

The GraphiQL page bundled with Spring for GraphQL loads JavaScript libraries from a public CDN, without Subresource Integrity checks. An attacker can inject malicious code in those scripts and execute arbitrary code on the browser loading the GraphiQL page. Spring for GraphQL 2.0.0 - 2.0.4 Spring for GraphQL 1.4.0 - 1.4.6 Spring for GraphQL 1.1.0 - 1.3.9 Spring for GraphQL 1.0.0 - 1.0.7

Affected products and versions

Product Affected versions Fixed in
Spring for GraphQL 2.0 2.0.0 → 2.0.4 No fix stated
Spring for GraphQL 1.4 1.4.0 → 1.4.6 No fix stated
Spring for GraphQL 1.1 1.1.0 → 1.3.9 No fix stated
Spring for GraphQL 1.0 1.0.0 → 1.0.7 No fix stated

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Spring for GraphQL

The 9 CVEs of Spring for GraphQL →
CVE-2026-59289 Spring for GraphQL's Spring Data pagination support resolves arguments of a scrollable query and forwards the… 7.5 High CVE-2026-59288 The GraphiQL page bundled with Spring for GraphQL sends requests to the GraphQL endpoints of the application 7.5 High CVE-2026-59287 Spring for GraphQL is vulnerable to Denial of Service attacks when using the WebSocket client with keepAlive enabled 5.9 Medium CVE-2026-59285 Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries 8.1 High
Track this CVE