CVE-2020-4038

Reflected XSS in GraphQL Playground

HIGH

7.4

CVSS Score

Published: June 8, 2020 at 08:40 PM UTC

Updated: June 17, 2026 at 03:19 AM UTC

5 products affected across 1 vendorGraphql Playground Middleware KoaGraphql Playground Middleware LambdaGraphql Playground Middleware Hapi

Using graphql-playground by prisma-labs?

Get instant alerts when new vulnerabilities affect graphql-playground - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.4

Exploit prediction

EPSS 7%

Description

GraphQL Playground (graphql-playground-html NPM package) before version 1.6.22 have a severe XSS Reflection attack vulnerability. All unsanitized user input passed into renderPlaygroundPage() method could trigger this vulnerability. This has been patched in graphql-playground-html version 1.6.22. Note that some of the associated dependent middleware packages are also affected including but not limited to graphql-playground-middleware-express before version 1.7.16, graphql-playground-middleware-koa before version 1.6.15, graphql-playground-middleware-lambda before version 1.7.17, and graphql-playground-middleware-hapi before 1.6.13.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Graphql Playground Html · Prismanpm

95%

v < 1.6.22

Affected range stops below 1.6.22, so it looks safe — our inference, not a vendor statement

Graphql Playground Middleware Express · Prismanpm

95%

v < 1.7.16

Affected range stops below 1.7.16, so it looks safe — our inference, not a vendor statement

Graphql Playground Middleware Hapi · Prismanpm

95%

v < 1.6.13

Affected range stops below 1.6.13, so it looks safe — our inference, not a vendor statement

Graphql Playground Middleware Koa · Prismanpm

95%

v < 1.6.15

Affected range stops below 1.6.15, so it looks safe — our inference, not a vendor statement

Graphql Playground Middleware Lambda · Prismanpm

95%

v < 1.7.17

Affected range stops below 1.7.17, so it looks safe — our inference, not a vendor statement

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

References (3)

x_refsource_MISCThird Party Advisory

Source: [email protected]

https://github.com/prisma-labs/graphql-playground#security-details

x_refsource_MISCPatchThird Party Advisory

Source: [email protected]

https://github.com/prisma-labs/graphql-playground/commit/bf1883db538c97b076801a60677733816cb3cfb7

x_refsource_CONFIRMMitigationThird Party Advisory

Source: [email protected]

https://github.com/prisma-labs/graphql-playground/security/advisories/GHSA-4852-vrh7-28rf

CVSS

7.4HIGHGitHub_M

Attack Vector: NETWORK
Complexity: LOW
Privileges: NONE
User Interaction: REQUIRED
Scope: CHANGED
Confidentiality: NONE
Integrity: HIGH
Availability: NONE

Vector?

Quick Info

StatusMODIFIED

CWE

CWE-79

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create account Sign in

Free plan, no card