https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 02 Nov 2026 17:32:20 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-118666 <p>GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to version 1.1.36 of the GraphQL Tools legacy WebSocket executor package, buildWSLegacyExecutor in packages/executors/legacy-ws/src/index.ts reuses one WebSocket and replaces its single websocket.onmessage handler whenever a new overlapping subscription starts. The handler delivers LEGACY_WS.DATA frames to the newest observer without comparing data.id with the subscription operation id, so a caller using the same executor can receive another user&#39;s authorized subscription payload while the earlier caller&#39;s stream is starved. This issue is fixed in version 1.1.36 of the GraphQL Tools legacy WebSocket executor package.</p> <p>GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to version 1.1.36 of the GraphQL Tools legacy WebSocket executor package, buildWSLegacyExecutor in packages/executors/legacy-ws/src/index.ts reuses one WebSocket and replaces its single websocket.onmessage handler whenever a new overlapping subscription starts. The handler delivers LEGACY_WS.DATA frames to the newest observer without comparing data.id with the subscription operation id, so a caller using the same executor can receive another user&#39;s authorized subscription payload while the earlier caller&#39;s stream is starved. This issue is fixed in version 1.1.36 of the GraphQL Tools legacy WebSocket executor package.</p> https://db.gcve.eu/vuln/fkie_cve-2026-118666 https://db.gcve.eu/vuln/ghsa-mp66-8ww2-pcwm <p><strong>Affected:</strong> npm: @graphql-tools/executor-legacy-ws</p> <p># Cross-tenant subscription data leak in `@graphql-tools/executor-legacy-ws`: a shared `websocket.onmessage` is replaced on every `subscribe()`, and `DATA` frames are delivered without checking the protocol operation id</p> <p>## Report metadata</p> <p>| Field | Value | | --- | --- | | Package | `@graphql-tools/executor-legacy-ws` (npm, `pkg:npm/%40graphql-tools/executor-legacy-ws`) | | Repository | https://github.com/ardatan/graphql-tools | | Component | `buildWSLegacyExecutor` → the returned executor&#39;s `subscribe(observer)` / `websocket.onmessage` handler | | Vulnerability class | Cross-tenant data leak (subscription results delivered to the wrong caller) | | Verified against | Source at `b5d1c36ebb8ed3868260ffee5bbcbb423ad5c1f1` (package version 1.1.33); published npm tarball `1.1.33` with matching source at `d304214db06e8a4ce9cb41138f199e3bc6ed36f2`; the same behaviour also reproduces on the current release `1.1.35` | | API surface | Public documented API (`buildWSLegacyExecutor`) | | Affected in default configuration | Yes — `ensureWebsocket()` reuses an already-`OPEN` socket (`index.ts:35-42`), and the socket has a single mutable `onmessage` property (`index.ts:113`). No single-operation-only restriction is documented, and the return type is the general reusable `DisposableExecutor` (`packages/utils/src/executor.ts:34-57`) |</p> <p>Affected version range: the range recorded for this finding is `&lt;= 1.1.33`, but that is understated — the same proof of concept reproduces on `1.1.35`, and a…</p> <p><strong>Affected:</strong> npm: @graphql-tools/executor-legacy-ws</p> <p># Cross-tenant subscription data leak in `@graphql-tools/executor-legacy-ws`: a shared `websocket.onmessage` is replaced on every `subscribe()`, and `DATA` frames are delivered without checking the protocol operation id</p> <p>## Report metadata</p> <p>| Field | Value | | --- | --- | | Package | `@graphql-tools/executor-legacy-ws` (npm, `pkg:npm/%40graphql-tools/executor-legacy-ws`) | | Repository | https://github.com/ardatan/graphql-tools | | Component | `buildWSLegacyExecutor` → the returned executor&#39;s `subscribe(observer)` / `websocket.onmessage` handler | | Vulnerability class | Cross-tenant data leak (subscription results delivered to the wrong caller) | | Verified against | Source at `b5d1c36ebb8ed3868260ffee5bbcbb423ad5c1f1` (package version 1.1.33); published npm tarball `1.1.33` with matching source at `d304214db06e8a4ce9cb41138f199e3bc6ed36f2`; the same behaviour also reproduces on the current release `1.1.35` | | API surface | Public documented API (`buildWSLegacyExecutor`) | | Affected in default configuration | Yes — `ensureWebsocket()` reuses an already-`OPEN` socket (`index.ts:35-42`), and the socket has a single mutable `onmessage` property (`index.ts:113`). No single-operation-only restriction is documented, and the return type is the general reusable `DisposableExecutor` (`packages/utils/src/executor.ts:34-57`) |</p> <p>Affected version range: the range recorded for this finding is `&lt;= 1.1.33`, but that is understated — the same proof of concept reproduces on `1.1.35`, and a…</p> https://db.gcve.eu/vuln/ghsa-mp66-8ww2-pcwm