GHSA-xf64-2f9p-6pqq

Source

https://github.com/advisories/GHSA-xf64-2f9p-6pqq

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-xf64-2f9p-6pqq/GHSA-xf64-2f9p-6pqq.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-xf64-2f9p-6pqq

Published

2020-09-04T17:24:08Z

Modified

2020-08-31T18:59:32Z

Summary

Information Exposure in type-graphql

Details

Versions of type-graphql prior to 0.17.6 are vulnerable to Information Exposure. The package leaks the resolver source code in an error message. It is possible to force this error when no subscription topics are provided in the request.

Recommendation

Upgrade to version 0.17.6 or later.

Database specific

{
    "cwe_ids":  [
        "CWE-209"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2020-08-31T18:59:32Z",
    "nvd_published_at":  null,
    "severity":  "LOW"
}

References

Affected packages

npm / type-graphql

Package

Name: type-graphql; View open source insights on deps.dev
Purl: pkg:npm/type-graphql

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.17.6

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-xf64-2f9p-6pqq/GHSA-xf64-2f9p-6pqq.json"