GraphQL Playground (graphql-playground-html NPM package) before version 1.6.22 have a severe XSS Reflection attack vulnerability. All unsanitized user input passed into renderPlaygroundPage() method could trigger this vulnerability. This has been patched in graphql-playground-html version 1.6.22. Note that some of the associated dependent middleware packages are also affected including but not limited to graphql-playground-middleware-express before version 1.7.16, graphql-playground-middleware-koa before version 1.6.15, graphql-playground-middleware-lambda before version 1.7.17, and graphql-playground-middleware-hapi before 1.6.13.
Affected: npm: graphql-playground-html
### Impact
**directly impacted:**
- `graphql-playground-html@<1.6.22` - all unsanitized user input for `renderPlaygroundPage()`
**all of our consuming packages** of `graphql-playground-html` are impacted:
- `graphql-playground-middleware-express@<1.7.16` - unsanitized user input to `expressPlayground()` - `graphql-playground-middleware-koa@<1.6.15` - unsanitized user input to `koaPlayground()` - `graphql-playground-middleware-lambda@<1.7.17` - unsanitized user input to `lambdaPlayground()` - `graphql-playground-middleware-hapi@<1.6.13` - unsanitized user input to `hapiPlayground()`
as well as ***any other packages*** that use these methods with unsanitized user input.
**not impacted:**
- `graphql-playground-electron` - uses `renderPlaygroundPage()` statically for a webpack build for electron bundle, no dynamic user input - `graphql-playground-react` - usage of the component directly in a react application does not expose reflected XSS vulnerabilities. only the demo in `public/` contains the vulnerability, because it uses an old version of the html pacakge.
### Patches
upgrading to the above mentioned versions will solve the issue.
If you're using `graphql-playground-html` directly, then:
``` yarn add graphql-playground-html@^1.6.22 ```
or
``` npm install --save graphql-playground-html@^1.6.22 ```
Then, similar steps need to be taken for each middleware:
- [Upgrade Express Middleware](https://www.npmjs.com/package/graphql-playground-middleware-express#security-…