{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "graphql-shield"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.0.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-285"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2020-08-31T18:47:59Z",
    "nvd_published_at": null,
    "severity": "LOW"
  },
  "details": "Versions of `graphql-shield` prior to 6.0.6 are vulnerable to an Authorization Bypass. The rule caching option `no_cache` relies on keys generated by cryptographically insecure functions, which may cause rules to be incorrectly cached. This allows attackers to access information they should not have access to in case of a key collision.\n\n\n## Recommendation\n\nUpgrade to version 6.0.6 or later.",
  "id": "GHSA-hx78-272p-mqqh",
  "modified": "2020-08-31T18:47:59Z",
  "published": "2020-09-03T19:21:11Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://www.npmjs.com/advisories/1121"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [],
  "summary": "Authorization Bypass in graphql-shield"
}