remorses/genql Code Injection Vulnerability

A code injection vulnerability has been identified in remorses/genql versions prior to 6.3.4. This issue allows an authenticated attacker to inject arbitrary JavaScript or TypeScript into the GraphQL schema that is processed by genql. The injected code is added to the generated schema.ts file and executes when the genql client is bundled and imported. This vulnerability arises from improper encoding of output, which can be exploited by manipulating type or field descriptions in the GraphQL schema.

Impact

Exploitation of this vulnerability allows for arbitrary code execution in the context of the application using the genql client.

Remediation

Users can upgrade to genql version 6.3.4 or later to address this vulnerability.