Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXhmNjQtMmY5cC02cHFx

Information Exposure in type-graphql

Versions of type-graphql prior to 0.17.6 are vulnerable to Information Exposure. The package leaks the resolver source code in an error message. It is possible to force this error when no subscription topics are provided in the request.

Recommendation

Upgrade to version 0.17.6 or later.

Permalink: https://github.com/advisories/GHSA-xf64-2f9p-6pqq
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXhmNjQtMmY5cC02cHFx
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Low
Classification: General
Published: over 3 years ago
Updated: over 1 year ago

Identifiers: GHSA-xf64-2f9p-6pqq
References:

• https://github.com/MichalLytek/type-graphql/issues/489
• https://www.npmjs.com/advisories/1444
• https://github.com/advisories/GHSA-xf64-2f9p-6pqq

Repository: https://github.com/MichalLytek/type-graphql
Blast Radius: 0.0

Affected Packages