Get real-time updates on Telegram
P4
CVE-2026-63397: genql 0 to before 6.3.4
CVE-2026-63397. CVSS 3.1 base score 6.4 (MEDIUM, Source advisory). EPSS 0.00477 (percentile 0.4029), scored 24-Oct-2026.
Affected technology
genql · 0 to before 6.3.4
remorses
Description’s affected range: before version 6.3.4
Component: Not specified by the source
Attack conditions (Source advisory, CVSS 4.0): Network (remote) · High privileges required · Active user interaction
What an attacker can do
An authenticated attacker with control of the GraphQL schema that is passed to genql can inject arbitrary JavaScript or TypeScript. Source advisory’s CVSS 4.0 assessment (base score 7.1/10) rates confidentiality, integrity and availability impact as high.
- CWE
- CWE-116
- CCR priority
- 25.7 /100 (P4)
- CVSS 3.1
- 6.4 /10 · CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H · Source advisory
- EPSS
- 0.00477 · percentile 0.4029 · 2026-10-24
- KEV
- no
Provenance
- NVD CVE API 2.0 · Source record · observed 2026-10-25 01:28:19.133527+00:00 UTC
Stable permalink: https://cybercodered.org/item/cve-cve-2026-63397.html