CVE-2026-63637

Dgraph is an open source distributed GraphQL database. Prior to 25.3.8, maybeQuoteArg in graphql/resolve/query_rewriter.go passes regexp filter strings into generated DQL without quoting or validating the /pattern/flags form, allowing crafted GraphQL query or mutation filters to inject DQL operators, disclose unintended nodes, or expand modification and deletion targets. This issue is fixed in version 25.3.8.

CVSS v3 8.6 HIGH

8.6^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 4.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/dgraph-io/dgraph/commit/aaff09ab9608f87d88e9d601e71d271306083392
https://github.com/dgraph-io/dgraph/security/advisories/GHSA-33p8-wc97-5qcj

Configurations

No configuration.

History

23 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Dgraph es una base de datos GraphQL distribuida de código abierto. Antes de la versión 25.3.8, maybeQuoteArg en graphql/resolve/query_rewriter.go pasa cadenas de filtro regexp a DQL generado sin entrecomillar o validar el formato /patrón/flags, permitiendo que filtros de consulta o mutación GraphQL manipulados inyecten operadores DQL, revelen nodos no deseados o expandan los objetivos de modificación y eliminación. Este problema se solucionó en la versión 25.3.8.

Information

Published : 2026-08-06 22:18

Updated : 2026-10-24 16:10

NVD link : CVE-2026-63637

Mitre link : CVE-2026-63637

CVE.ORG link : CVE-2026-63637

JSON object : View

Products Affected

No product.

CWE

CWE-943

Improper Neutralization of Special Elements in Data Query Logic

{"id": "CVE-2026-63637", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-63637", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-07T16:53:49.860450Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 4.7, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "dgraph-io", "product": "dgraph", "versions": [{"status": "affected", "version": "< 25.3.8"}]}]}], "published": "2026-08-06T22:18:12.330", "references": [{"url": "https://github.com/dgraph-io/dgraph/commit/aaff09ab9608f87d88e9d601e71d271306083392", "source": "security-advisories@github.com"}, {"url": "https://github.com/dgraph-io/dgraph/security/advisories/GHSA-33p8-wc97-5qcj", "source": "security-advisories@github.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-943"}]}], "descriptions": [{"lang": "en", "value": "Dgraph is an open source distributed GraphQL database. Prior to 25.3.8, maybeQuoteArg in graphql/resolve/query_rewriter.go passes regexp filter strings into generated DQL without quoting or validating the /pattern/flags form, allowing crafted GraphQL query or mutation filters to inject DQL operators, disclose unintended nodes, or expand modification and deletion targets. This issue is fixed in version 25.3.8."}, {"lang": "es", "value": "Dgraph es una base de datos GraphQL distribuida de c\u00f3digo abierto. Antes de la versi\u00f3n 25.3.8, maybeQuoteArg en graphql/resolve/query_rewriter.go pasa cadenas de filtro regexp a DQL generado sin entrecomillar o validar el formato /patr\u00f3n/flags, permitiendo que filtros de consulta o mutaci\u00f3n GraphQL manipulados inyecten operadores DQL, revelen nodos no deseados o expandan los objetivos de modificaci\u00f3n y eliminaci\u00f3n. Este problema se solucion\u00f3 en la versi\u00f3n 25.3.8."}], "lastModified": "2026-10-24T16:10:00.153", "sourceIdentifier": "security-advisories@github.com"}