GO-2026-5837

See a problem?
Please try reporting it to the source first.

Source

https://pkg.go.dev/vuln/GO-2026-5837

Import Source

https://vuln.go.dev/ID/GO-2026-5837.json

JSON Data

https://api.osv.dev/v1/vulns/GO-2026-5837

Aliases

Published

2026-07-07T15:26:32Z

Modified

2026-07-23T17:45:22Z

Summary

DQL injection via checkUserPassword GraphQL query in github.com/dgraph-io/dgraph

Details

The checkUserPassword GraphQL query in Dgraph is vulnerable to Dgraph Query Language (DQL) injection. User-supplied password values are interpolated directly into a DQL checkpwd query without escaping or parameterization. An attacker can inject a password containing a double-quote character to break out of the DQL string literal and append arbitrary DQL query blocks.

Database specific

{
    "review_status": "REVIEWED",
    "url": "https://pkg.go.dev/vuln/GO-2026-5837"
}

References

Affected packages

Go / github.com/dgraph-io/dgraph

Package

Name: github.com/dgraph-io/dgraph; View open source insights on deps.dev
Purl: pkg:golang/github.com/dgraph-io/dgraph

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Ecosystem specific

{
    "imports": [
        {
            "path": "github.com/dgraph-io/dgraph"
        }
    ]
}

Database specific

source

"https://vuln.go.dev/ID/GO-2026-5837.json"

Go / github.com/hypermodeinc/dgraph/v24

Package

Name: github.com/hypermodeinc/dgraph/v24; View open source insights on deps.dev
Purl: pkg:golang/github.com/hypermodeinc/dgraph/v24

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Ecosystem specific

{
    "imports": [
        {
            "path": "github.com/hypermodeinc/dgraph/v24"
        }
    ]
}

Database specific

source

"https://vuln.go.dev/ID/GO-2026-5837.json"

Go / github.com/dgraph-io/dgraph/v25

Package

Name: github.com/dgraph-io/dgraph/v25; View open source insights on deps.dev
Purl: pkg:golang/github.com/dgraph-io/dgraph/v25

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

25.3.4

Ecosystem specific

{
    "imports": [
        {
            "path": "github.com/dgraph-io/dgraph/v25"
        }
    ]
}

Database specific

source

"https://vuln.go.dev/ID/GO-2026-5837.json"