CVE-2024-24556

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2024-24556

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-24556.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2024-24556

Aliases

GHSA-qhjf-hm5j-335w

Published

2024-01-30T17:21:19.964Z

Modified

2026-07-15T01:49:11.621559061Z

Severity

7.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N CVSS Calculator

Summary

XSS in @urql/next

Details

urql is a GraphQL client that exposes a set of helpers for several frameworks. The @urql/next package is vulnerable to XSS. To exploit this an attacker would need to ensure that the response returns html tags and that the web-application is using streamed responses (non-RSC). This vulnerability is due to improper escaping of html-like characters in the response-stream. To fix this vulnerability upgrade to version 1.1.1

Database specific

{
    "cwe_ids": [
        "CWE-79"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/24xxx/CVE-2024-24556.json",
    "cna_assigner": "GitHub_M"
}

References

Affected packages

Git / github.com/urql-graphql/urql

Affected ranges

Type

GIT

Repo

https://github.com/urql-graphql/urql

Events

Introduced

Fixed

bc09338d13db9d512665e47809b9d6554da4b7ac

Fixed

4b7011b70d5718728ff912d02a4dbdc7f703540d

Database specific

{
    "cpe": "cpe:2.3:a:nearform:urql:*:*:*:*:*:node.js:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.1.1"
        }
    ],
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

@urql/core@1.*

@urql/core@1.10.0

@urql/core@1.10.1

@urql/core@1.10.2

@urql/core@1.10.3

@urql/core@1.10.4

@urql/core@1.10.5

@urql/core@1.10.6

@urql/core@1.10.7

@urql/core@1.10.8

@urql/core@1.10.9

@urql/core@1.11.0

@urql/core@1.11.1

@urql/core@1.11.4

@urql/core@1.11.5

@urql/core@1.11.6

@urql/core@1.11.7

@urql/core@1.11.8

@urql/core@1.12.0

@urql/core@1.12.1

@urql/core@1.12.2

@urql/core@1.12.3

@urql/core@1.13.0

@urql/core@1.13.1

@urql/core@1.14.0

@urql/core@1.14.1

@urql/core@1.15.0

@urql/core@1.15.1

@urql/core@1.15.2

@urql/core@1.16.0

@urql/core@1.16.1

@urql/core@1.16.2

@urql/core@1.9.0

@urql/core@1.9.1

@urql/core@1.9.2

@urql/core@2.*

@urql/core@2.0.0

@urql/core@2.1.0

@urql/core@2.1.1

@urql/core@2.1.2

@urql/core@2.1.3

@urql/core@2.1.4

@urql/core@2.1.5

@urql/core@2.1.6

@urql/core@2.2.0

@urql/core@2.3.0

@urql/core@2.3.1

@urql/core@2.3.2

@urql/core@2.3.3

@urql/core@2.3.4

@urql/core@2.3.5

@urql/core@2.3.6

@urql/core@2.4.0

@urql/core@2.4.1

@urql/core@2.4.2

@urql/core@2.4.3

@urql/core@2.4.4

@urql/core@2.5.0

@urql/core@2.6.0

@urql/core@2.6.1

@urql/core@3.*

@urql/core@3.0.0

@urql/core@3.0.1

@urql/core@3.0.2

@urql/core@3.0.3

@urql/core@3.0.4

@urql/core@3.0.5

@urql/core@3.1.0

@urql/core@3.1.1

@urql/core@3.2.1

@urql/core@3.2.2

@urql/core@4.*

@urql/core@4.0.0

@urql/core@4.0.1

@urql/core@4.0.10

@urql/core@4.0.11

@urql/core@4.0.2

@urql/core@4.0.3

@urql/core@4.0.4

@urql/core@4.0.5

@urql/core@4.0.6

@urql/core@4.0.7

@urql/core@4.0.8

@urql/core@4.0.9

@urql/core@4.1.0

@urql/core@4.1.1

@urql/core@4.1.2

@urql/core@4.1.3

@urql/core@4.1.4

@urql/core@4.2.0

@urql/core@4.2.1

@urql/core@4.2.2

@urql/core@4.2.3

@urql/exchange-auth@0.*

@urql/exchange-auth@0.1.0

@urql/exchange-auth@0.1.1

@urql/exchange-auth@0.1.2

@urql/exchange-auth@0.1.3

@urql/exchange-auth@0.1.4

@urql/exchange-auth@0.1.5

@urql/exchange-auth@0.1.6

@urql/exchange-auth@0.1.7

@urql/exchange-auth@1.*

@urql/exchange-auth@1.0.0

@urql/exchange-auth@2.*

@urql/exchange-auth@2.0.0

@urql/exchange-auth@2.1.0

@urql/exchange-auth@2.1.1

@urql/exchange-auth@2.1.2

@urql/exchange-auth@2.1.3

@urql/exchange-auth@2.1.4

@urql/exchange-auth@2.1.5

@urql/exchange-auth@2.1.6

@urql/exchange-context@0.*

@urql/exchange-context@0.1.0

@urql/exchange-context@0.2.0

@urql/exchange-context@0.2.1

@urql/exchange-execute@1.*

@urql/exchange-execute@1.0.0

@urql/exchange-execute@1.0.1

@urql/exchange-execute@1.0.2

@urql/exchange-execute@1.0.3

@urql/exchange-execute@1.0.4

@urql/exchange-execute@1.0.5

@urql/exchange-execute@1.1.0

@urql/exchange-execute@1.2.0

@urql/exchange-execute@1.2.1

@urql/exchange-execute@1.2.2

@urql/exchange-execute@1.2.3

@urql/exchange-execute@2.*

@urql/exchange-execute@2.0.0

@urql/exchange-execute@2.1.0

@urql/exchange-execute@2.1.1

@urql/exchange-execute@2.2.0

@urql/exchange-execute@2.2.1

@urql/exchange-execute@2.2.2

@urql/exchange-graphcache@2.*

@urql/exchange-graphcache@2.1.1

@urql/exchange-graphcache@2.2.0

@urql/exchange-graphcache@2.2.1

@urql/exchange-graphcache@2.2.2

@urql/exchange-graphcache@2.2.3

@urql/exchange-graphcache@2.2.4

@urql/exchange-graphcache@2.2.5

@urql/exchange-graphcache@2.2.6

@urql/exchange-graphcache@2.2.7

@urql/exchange-graphcache@2.2.8

@urql/exchange-graphcache@2.3.0

@urql/exchange-graphcache@2.3.1

@urql/exchange-graphcache@2.3.2

@urql/exchange-graphcache@2.3.3

@urql/exchange-graphcache@2.3.4

@urql/exchange-graphcache@2.3.5

@urql/exchange-graphcache@2.3.8

@urql/exchange-graphcache@2.4.0

@urql/exchange-graphcache@2.4.1

@urql/exchange-graphcache@2.4.2

@urql/exchange-graphcache@3.*

@urql/exchange-graphcache@3.0.0

@urql/exchange-graphcache@3.0.1

@urql/exchange-graphcache@3.0.2

@urql/exchange-graphcache@3.1.0

@urql/exchange-graphcache@3.1.1

@urql/exchange-graphcache@3.1.10

@urql/exchange-graphcache@3.1.11

@urql/exchange-graphcache@3.1.2

@urql/exchange-graphcache@3.1.3

@urql/exchange-graphcache@3.1.4

@urql/exchange-graphcache@3.1.5

@urql/exchange-graphcache@3.1.6

@urql/exchange-graphcache@3.1.7

@urql/exchange-graphcache@3.1.8

@urql/exchange-graphcache@3.1.9

@urql/exchange-graphcache@3.2.0

@urql/exchange-graphcache@3.3.0

@urql/exchange-graphcache@3.3.1

@urql/exchange-graphcache@3.3.2

@urql/exchange-graphcache@3.3.3

@urql/exchange-graphcache@3.3.4

@urql/exchange-graphcache@3.4.0

@urql/exchange-graphcache@4.*

@urql/exchange-graphcache@4.0.0

@urql/exchange-graphcache@4.1.0

@urql/exchange-graphcache@4.1.1

@urql/exchange-graphcache@4.1.2

@urql/exchange-graphcache@4.1.3

@urql/exchange-graphcache@4.1.4

@urql/exchange-graphcache@4.2.0

@urql/exchange-graphcache@4.2.1

@urql/exchange-graphcache@4.3.0

@urql/exchange-graphcache@4.3.1

@urql/exchange-graphcache@4.3.2

@urql/exchange-graphcache@4.3.3

@urql/exchange-graphcache@4.3.4

@urql/exchange-graphcache@4.3.5

@urql/exchange-graphcache@4.3.6

@urql/exchange-graphcache@4.4.0

@urql/exchange-graphcache@4.4.1

@urql/exchange-graphcache@4.4.2

@urql/exchange-graphcache@4.4.3

@urql/exchange-graphcache@5.*

@urql/exchange-graphcache@5.0.0

@urql/exchange-graphcache@5.0.1

@urql/exchange-graphcache@5.0.2

@urql/exchange-graphcache@5.0.3

@urql/exchange-graphcache@5.0.4

@urql/exchange-graphcache@5.0.5

@urql/exchange-graphcache@5.0.6

@urql/exchange-graphcache@5.0.7

@urql/exchange-graphcache@5.0.8

@urql/exchange-graphcache@5.0.9

@urql/exchange-graphcache@5.2.0

@urql/exchange-graphcache@6.*

@urql/exchange-graphcache@6.0.0

@urql/exchange-graphcache@6.0.1

@urql/exchange-graphcache@6.0.2

@urql/exchange-graphcache@6.0.3

@urql/exchange-graphcache@6.0.4

@urql/exchange-graphcache@6.1.0

@urql/exchange-graphcache@6.1.1

@urql/exchange-graphcache@6.1.2

@urql/exchange-graphcache@6.1.3

@urql/exchange-graphcache@6.1.4

@urql/exchange-graphcache@6.2.0

@urql/exchange-graphcache@6.3.0

@urql/exchange-graphcache@6.3.1

@urql/exchange-graphcache@6.3.2

@urql/exchange-graphcache@6.3.3

@urql/exchange-graphcache@6.4.0

@urql/exchange-multipart-fetch@0.*

@urql/exchange-multipart-fetch@0.1.0

@urql/exchange-multipart-fetch@0.1.1

@urql/exchange-multipart-fetch@0.1.10

@urql/exchange-multipart-fetch@0.1.11

@urql/exchange-multipart-fetch@0.1.12

@urql/exchange-multipart-fetch@0.1.13

@urql/exchange-multipart-fetch@0.1.14

@urql/exchange-multipart-fetch@0.1.2

@urql/exchange-multipart-fetch@0.1.3

@urql/exchange-multipart-fetch@0.1.4

@urql/exchange-multipart-fetch@0.1.5

@urql/exchange-multipart-fetch@0.1.6

@urql/exchange-multipart-fetch@0.1.7

@urql/exchange-multipart-fetch@0.1.8

@urql/exchange-multipart-fetch@0.1.9

@urql/exchange-multipart-fetch@1.*

@urql/exchange-multipart-fetch@1.0.0

@urql/exchange-multipart-fetch@1.0.1

@urql/exchange-multipart-fetch@1.1.0

@urql/exchange-persisted-fetch@0.*

@urql/exchange-persisted-fetch@0.1.0

@urql/exchange-persisted-fetch@0.1.1

@urql/exchange-persisted-fetch@0.1.2

@urql/exchange-persisted-fetch@0.1.3

@urql/exchange-persisted-fetch@1.*

@urql/exchange-persisted-fetch@1.0.0

@urql/exchange-persisted-fetch@1.0.1

@urql/exchange-persisted-fetch@1.1.0

@urql/exchange-persisted-fetch@1.2.0

@urql/exchange-persisted-fetch@1.2.1

@urql/exchange-persisted-fetch@1.2.2

@urql/exchange-persisted-fetch@1.2.3

@urql/exchange-persisted-fetch@1.3.0

@urql/exchange-persisted-fetch@1.3.1

@urql/exchange-persisted-fetch@1.3.2

@urql/exchange-persisted-fetch@1.3.3

@urql/exchange-persisted-fetch@1.3.4

@urql/exchange-persisted-fetch@2.*

@urql/exchange-persisted-fetch@2.0.0

@urql/exchange-persisted-fetch@2.1.0

@urql/exchange-persisted@3.*

@urql/exchange-persisted@3.0.0

@urql/exchange-persisted@3.0.1

@urql/exchange-persisted@4.*

@urql/exchange-persisted@4.0.0

@urql/exchange-persisted@4.0.1

@urql/exchange-persisted@4.1.0

@urql/exchange-persisted@4.1.1

@urql/exchange-populate@0.*

@urql/exchange-populate@0.1.0

@urql/exchange-populate@0.1.1

@urql/exchange-populate@0.1.2

@urql/exchange-populate@0.1.3

@urql/exchange-populate@0.1.4

@urql/exchange-populate@0.1.5

@urql/exchange-populate@0.1.6

@urql/exchange-populate@0.1.7

@urql/exchange-populate@0.1.8

@urql/exchange-populate@0.2.0

@urql/exchange-populate@0.2.1

@urql/exchange-populate@0.2.2

@urql/exchange-populate@0.2.3

@urql/exchange-populate@1.*

@urql/exchange-populate@1.0.0

@urql/exchange-populate@1.1.0

@urql/exchange-populate@1.1.1

@urql/exchange-populate@1.1.2

@urql/exchange-refocus@0.*

@urql/exchange-refocus@0.1.0

@urql/exchange-refocus@0.2.0

@urql/exchange-refocus@0.2.1

@urql/exchange-refocus@0.2.2

@urql/exchange-refocus@0.2.3

@urql/exchange-refocus@0.2.4

@urql/exchange-refocus@0.2.5

@urql/exchange-refocus@1.*

@urql/exchange-refocus@1.0.0

@urql/exchange-refocus@1.0.1

@urql/exchange-refocus@1.0.2

@urql/exchange-request-policy@0.*

@urql/exchange-request-policy@0.1.0

@urql/exchange-request-policy@0.1.1

@urql/exchange-request-policy@0.1.2

@urql/exchange-request-policy@0.1.3

@urql/exchange-request-policy@0.1.4

@urql/exchange-request-policy@0.1.5

@urql/exchange-request-policy@1.*

@urql/exchange-request-policy@1.0.0

@urql/exchange-request-policy@1.0.1

@urql/exchange-request-policy@1.0.2

@urql/exchange-retry@0.*

@urql/exchange-retry@0.1.0

@urql/exchange-retry@0.1.1

@urql/exchange-retry@0.1.10

@urql/exchange-retry@0.1.2

@urql/exchange-retry@0.1.3

@urql/exchange-retry@0.1.4

@urql/exchange-retry@0.1.5

@urql/exchange-retry@0.1.6

@urql/exchange-retry@0.1.7

@urql/exchange-retry@0.1.8

@urql/exchange-retry@0.1.9

@urql/exchange-retry@0.2.0

@urql/exchange-retry@0.2.1

@urql/exchange-retry@0.3.0

@urql/exchange-retry@0.3.1

@urql/exchange-retry@0.3.2

@urql/exchange-retry@0.3.3

@urql/exchange-retry@1.*

@urql/exchange-retry@1.0.0

@urql/exchange-retry@1.1.0

@urql/exchange-retry@1.1.1

@urql/exchange-retry@1.2.0

@urql/exchange-retry@1.2.1

@urql/exchange-suspense@1.*

@urql/exchange-suspense@1.8.3

@urql/exchange-suspense@1.8.4

@urql/exchange-suspense@1.8.5

@urql/exchange-suspense@1.8.6

@urql/exchange-suspense@1.8.7

@urql/exchange-suspense@1.8.8

@urql/exchange-suspense@1.8.9

@urql/exchange-suspense@1.9.0

@urql/exchange-suspense@1.9.1

@urql/exchange-suspense@1.9.2

@urql/introspection@0.*

@urql/introspection@0.1.0

@urql/introspection@0.1.1

@urql/introspection@0.1.2

@urql/introspection@0.2.0

@urql/introspection@0.3.0

@urql/introspection@0.3.1

@urql/introspection@0.3.2

@urql/introspection@0.3.3

@urql/introspection@1.*

@urql/introspection@1.0.0

@urql/introspection@1.0.1

@urql/introspection@1.0.2

@urql/introspection@1.0.3

@urql/next@1.*

@urql/next@1.0.0

@urql/next@1.1.0

@urql/preact@1.*

@urql/preact@1.1.1

@urql/preact@1.1.2

@urql/preact@1.1.3

@urql/preact@1.1.4

@urql/preact@1.1.5

@urql/preact@1.1.6

@urql/preact@1.1.7

@urql/preact@1.1.8

@urql/preact@1.2.0

@urql/preact@1.2.1

@urql/preact@1.3.0

@urql/preact@1.3.1

@urql/preact@1.3.2

@urql/preact@1.4.0

@urql/preact@1.4.1

@urql/preact@1.4.2

@urql/preact@1.4.3

@urql/preact@1.4.4

@urql/preact@2.*

@urql/preact@2.0.0

@urql/preact@2.0.1

@urql/preact@2.0.2

@urql/preact@2.0.3

@urql/preact@2.0.4

@urql/preact@3.*

@urql/preact@3.0.0

@urql/preact@3.0.1

@urql/preact@3.0.2

@urql/preact@3.0.3

@urql/preact@4.*

@urql/preact@4.0.0

@urql/preact@4.0.1

@urql/preact@4.0.2

@urql/preact@4.0.3

@urql/preact@4.0.4

@urql/storage-rn@0.*

@urql/storage-rn@0.1.0

@urql/storage-rn@0.1.1

@urql/storage-rn@1.*

@urql/storage-rn@1.0.0

@urql/storage-rn@1.0.1

@urql/storage-rn@1.0.2

@urql/storage-rn@1.0.3

@urql/storage-rn@1.1.0

@urql/storybook-addon@1.*

@urql/storybook-addon@1.0.3

@urql/storybook-addon@1.0.4

@urql/storybook-addon@1.0.5

@urql/storybook-addon@1.0.6

@urql/storybook-addon@1.0.7

@urql/storybook-addon@1.0.8

@urql/storybook-addon@1.0.9

@urql/storybook-addon@2.*

@urql/storybook-addon@2.0.0

@urql/storybook-addon@2.0.1

@urql/svelte@0.*

@urql/svelte@0.1.0

@urql/svelte@0.1.0-alpha.0

@urql/svelte@0.1.1

@urql/svelte@0.1.2

@urql/svelte@0.1.3

@urql/svelte@0.2.0

@urql/svelte@0.2.1

@urql/svelte@0.2.2

@urql/svelte@0.2.3

@urql/svelte@0.2.4

@urql/svelte@0.3.0

@urql/svelte@0.4.0

@urql/svelte@1.*

@urql/svelte@1.0.0

@urql/svelte@1.0.1

@urql/svelte@1.1.0

@urql/svelte@1.1.1

@urql/svelte@1.1.2

@urql/svelte@1.1.3

@urql/svelte@1.1.4

@urql/svelte@1.2.0

@urql/svelte@1.2.1

@urql/svelte@1.2.2

@urql/svelte@1.2.3

@urql/svelte@1.3.0

@urql/svelte@1.3.1

@urql/svelte@1.3.2

@urql/svelte@1.3.3

@urql/svelte@2.*

@urql/svelte@2.0.0

@urql/svelte@2.0.1

@urql/svelte@2.0.2

@urql/svelte@3.*

@urql/svelte@3.0.0

@urql/svelte@3.0.1

@urql/svelte@3.0.2

@urql/svelte@3.0.3

@urql/svelte@3.0.4

@urql/svelte@4.*

@urql/svelte@4.0.0

@urql/svelte@4.0.1

@urql/svelte@4.0.2

@urql/svelte@4.0.3

@urql/svelte@4.0.4

@urql/vue@0.*

@urql/vue@0.1.0

@urql/vue@0.2.0

@urql/vue@0.2.1

@urql/vue@0.3.0

@urql/vue@0.4.0

@urql/vue@0.4.1

@urql/vue@0.4.2

@urql/vue@0.4.3

@urql/vue@0.5.0

@urql/vue@0.6.0

@urql/vue@0.6.1

@urql/vue@0.6.2

@urql/vue@0.6.3

@urql/vue@0.6.4

@urql/vue@1.*

@urql/vue@1.0.0

@urql/vue@1.0.1

@urql/vue@1.0.2

@urql/vue@1.0.3

@urql/vue@1.0.4

@urql/vue@1.0.5

@urql/vue@1.1.0

@urql/vue@1.1.1

@urql/vue@1.1.2

next-urql@0.*

next-urql@0.3.1

next-urql@0.3.2

next-urql@0.3.3

next-urql@0.3.4

next-urql@0.3.5

next-urql@0.3.6

next-urql@0.3.7

next-urql@0.3.8

next-urql@1.*

next-urql@1.0.0

next-urql@1.0.1

next-urql@1.0.2

next-urql@1.1.0

next-urql@1.2.0

next-urql@2.*

next-urql@2.0.0

next-urql@2.1.0

next-urql@2.1.1

next-urql@2.2.0

next-urql@3.*

next-urql@3.0.0

next-urql@3.0.1

next-urql@3.1.0

next-urql@3.1.1

next-urql@3.2.0

next-urql@3.2.1

next-urql@3.3.0

next-urql@3.3.1

next-urql@3.3.2

next-urql@3.3.3

next-urql@4.*

next-urql@4.0.0

next-urql@4.0.1

next-urql@4.0.2

next-urql@4.0.3

next-urql@5.*

next-urql@5.0.0

next-urql@5.0.1

next-urql@5.0.2

urql@1.*

urql@1.10.0

urql@1.10.1

urql@1.10.2

urql@1.10.3

urql@1.11.0

urql@1.11.1

urql@1.11.2

urql@1.11.3

urql@1.11.4

urql@1.11.5

urql@1.11.6

urql@1.9.0

urql@1.9.1

urql@1.9.2

urql@1.9.3

urql@1.9.4

urql@1.9.5

urql@1.9.6

urql@1.9.7

urql@1.9.8

urql@2.*

urql@2.0.0

urql@2.0.1

urql@2.0.2

urql@2.0.3

urql@2.0.4

urql@2.0.5

urql@2.0.6

urql@2.1.0

urql@2.1.1

urql@2.1.2

urql@2.1.3

urql@2.2.0

urql@2.2.1

urql@2.2.2

urql@2.2.3

urql@3.*

urql@3.0.0

urql@3.0.1

urql@3.0.2

urql@3.0.3

urql@3.0.4

urql@4.*

urql@4.0.0

urql@4.0.1

urql@4.0.2

urql@4.0.3

urql@4.0.4

urql@4.0.5

urql@4.0.6

v0.*

v0.0.10

v0.0.11

v0.0.2

v0.0.3

v0.0.4

v0.0.5

v0.0.6

v0.0.7

v0.0.8

v0.0.9

v0.1.0

v0.1.1

v0.2.0

v0.2.1

v0.3.0-next1

v1.*

v1.0.0

v1.0.1

v1.0.2

v1.0.3

v1.0.4

v1.0.5

v1.1.0

v1.1.1

v1.1.2

v1.1.3

v1.2.0

v1.3.0

v1.4.0

v1.4.1

v1.5.0

v1.5.1

v1.6.0

v1.6.1

v1.6.2

v1.6.3

v1.7.0

v1.8.0

v1.8.1

v1.8.2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-24556.json"