https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 18:45:07 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-335242 EUVD-2026-335242 https://cve.radiocsirt.org/vuln/euvd-2026-335242 https://cve.radiocsirt.org/vuln/fkie_cve-2026-44840 <p>Dgraph is an open source distributed GraphQL database. Prior to version 25.3.4, the `checkUserPassword` GraphQL query in Dgraph is vulnerable to DQL (Dgraph Query Language) injection. User-supplied password values are interpolated directly into a DQL `checkpwd()` query via `fmt.Sprintf` without any escaping or parameterization. An attacker can inject a password containing a double-quote character to break out of the DQL string literal and append arbitrary DQL query blocks. Version 25.3.4 patches the issue.</p> <p>Dgraph is an open source distributed GraphQL database. Prior to version 25.3.4, the `checkUserPassword` GraphQL query in Dgraph is vulnerable to DQL (Dgraph Query Language) injection. User-supplied password values are interpolated directly into a DQL `checkpwd()` query via `fmt.Sprintf` without any escaping or parameterization. An attacker can inject a password containing a double-quote character to break out of the DQL string literal and append arbitrary DQL query blocks. Version 25.3.4 patches the issue.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-44840 https://cve.radiocsirt.org/vuln/ghsa-q2m9-6jp9-c6mc <p><strong>Affected:</strong> Go: github.com/dgraph-io/dgraph/v25</p> <p>## Summary</p> <p>The `checkUserPassword` GraphQL query in Dgraph is vulnerable to DQL (Dgraph Query Language) injection. User-supplied password values are interpolated directly into a DQL `checkpwd()` query via `fmt.Sprintf` without any escaping or parameterization. An attacker can inject a password containing a double-quote character to break out of the DQL string literal and append arbitrary DQL query blocks.</p> <p>## Details</p> <p>### Vulnerable Code Path</p> <p>The vulnerability exists in the GraphQL-to-DQL query rewriting layer:</p> <p>1. **`query_rewriter.go` (~line 364)** — The `checkpwd()` DQL function is constructed using `fmt.Sprintf`:</p> <p>```go fmt.Sprintf(`checkpwd(User.password, &#34;%s&#34;)`, password) ```</p> <p>The raw password string from the GraphQL query input is embedded directly into the DQL query without escaping double quotes or other special characters.</p> <p>2. **`graphquery.go`** — The constructed query attribute is serialized into the final DQL string via `b.WriteString(query.Attr)`, passing the unsanitized content directly to the Dgraph query engine.</p> <p>### Attack Mechanism</p> <p>A password value containing a double-quote (`&#34;`) terminates the string literal in the `checkpwd()` function. Any content after the escaped quote is parsed as additional DQL, allowing the attacker to inject arbitrary query blocks.</p> <p>### Distinction from CVE-2026-41328 and CVE-2026-41327</p> <p>CVE-2026-41328 and CVE-2026-41327 address DQL injection in **`edgraph/server.go`**, where GraphQL mutation inputs (upsert/delete)…</p> <p><strong>Affected:</strong> Go: github.com/dgraph-io/dgraph/v25</p> <p>## Summary</p> <p>The `checkUserPassword` GraphQL query in Dgraph is vulnerable to DQL (Dgraph Query Language) injection. User-supplied password values are interpolated directly into a DQL `checkpwd()` query via `fmt.Sprintf` without any escaping or parameterization. An attacker can inject a password containing a double-quote character to break out of the DQL string literal and append arbitrary DQL query blocks.</p> <p>## Details</p> <p>### Vulnerable Code Path</p> <p>The vulnerability exists in the GraphQL-to-DQL query rewriting layer:</p> <p>1. **`query_rewriter.go` (~line 364)** — The `checkpwd()` DQL function is constructed using `fmt.Sprintf`:</p> <p>```go fmt.Sprintf(`checkpwd(User.password, &#34;%s&#34;)`, password) ```</p> <p>The raw password string from the GraphQL query input is embedded directly into the DQL query without escaping double quotes or other special characters.</p> <p>2. **`graphquery.go`** — The constructed query attribute is serialized into the final DQL string via `b.WriteString(query.Attr)`, passing the unsanitized content directly to the Dgraph query engine.</p> <p>### Attack Mechanism</p> <p>A password value containing a double-quote (`&#34;`) terminates the string literal in the `checkpwd()` function. Any content after the escaped quote is parsed as additional DQL, allowing the attacker to inject arbitrary query blocks.</p> <p>### Distinction from CVE-2026-41328 and CVE-2026-41327</p> <p>CVE-2026-41328 and CVE-2026-41327 address DQL injection in **`edgraph/server.go`**, where GraphQL mutation inputs (upsert/delete)…</p> https://cve.radiocsirt.org/vuln/ghsa-q2m9-6jp9-c6mc