CVE-2026-63397CWE-116

remorses/genql code injection

High · published July 16, 2026

CVSS v4.0
7.1
EPSS
0%
Percentile
40.2
In the wild
Unconfirmed
What it is

remorses/genql before version 6.3.4 allows an authenticated attacker with control of the GraphQL schema that is passed to genql to inject arbitrary JavaScript or TypeScript. The malicious code is injected into the generated schema.ts file and executes when the genql client is bundled and imported.

The record
Technical detail
CVSS v4.0
7.1 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00477 · 40.2th percentile
Weakness
CWE-116 · Improper Encoding or Escaping of Output
Published
2026-07-16T19:14Z
EPSS history
Timeline
  • 16 JUL 19:14Z
    remorses/genql code injection
    cvelistv5