cnvd-2020-36614

EUVD-2026-36350

fkie_cve-2020-4038

GraphQL Playground (graphql-playground-html NPM package) before version 1.6.22 have a severe XSS Reflection attack vulnerability. All unsanitized user input passed into renderPlaygroundPage() method could trigger this vulnerability. This has been patched in graphql-playground-html version 1.6.22. Note that some of the associated dependent middleware packages are also affected including but not limited to graphql-playground-middleware-express before version 1.7.16, graphql-playground-middleware-koa before version 1.6.15, graphql-playground-middleware-lambda before version 1.7.17, and graphql-playground-middleware-hapi before 1.6.13.

GHSA-4852-vrh7-28rf — Reflected XSS in GraphQL Playground

Affected: npm: graphql-playground-html

### Impact

**directly impacted:**

- `graphql-playground-html@<1.6.22` - all unsanitized user input for `renderPlaygroundPage()`

**all of our consuming packages** of `graphql-playground-html` are impacted:

- `graphql-playground-middleware-express@<1.7.16` - unsanitized user input to `expressPlayground()` - `graphql-playground-middleware-koa@<1.6.15` - unsanitized user input to `koaPlayground()` - `graphql-playground-middleware-lambda@<1.7.17` - unsanitized user input to `lambdaPlayground()` - `graphql-playground-middleware-hapi@<1.6.13` - unsanitized user input to `hapiPlayground()`

as well as ***any other packages*** that use these methods with unsanitized user input.

**not impacted:**

- `graphql-playground-electron` - uses `renderPlaygroundPage()` statically for a webpack build for electron bundle, no dynamic user input - `graphql-playground-react` - usage of the component directly in a react application does not expose reflected XSS vulnerabilities. only the demo in `public/` contains the vulnerability, because it uses an old version of the html pacakge.

### Patches

upgrading to the above mentioned versions will solve the issue.

If you're using `graphql-playground-html` directly, then:

``` yarn add graphql-playground-html@^1.6.22 ```

``` npm install --save graphql-playground-html@^1.6.22 ```

Then, similar steps need to be taken for each middleware:

- [Upgrade Express Middleware](https://www.npmjs.com/package/graphql-playground-middleware-express#security-…

Most recent entries from all

cnvd-2020-36614

EUVD-2026-36350

fkie_cve-2020-4038

GHSA-4852-vrh7-28rf — Reflected XSS in GraphQL Playground

gsd-2020-4038