CVE-2020-4038

HighCVSS 7.4/10Last modified Jun 17, 2026

Description

GraphQL Playground (graphql-playground-html NPM package) before version 1.6.22 have a severe XSS Reflection attack vulnerability. All unsanitized user input passed into renderPlaygroundPage() method could trigger this vulnerability. This has been patched in graphql-playground-html version 1.6.22. Note that some of the associated dependent middleware packages are also affected including but not limited to graphql-playground-middleware-express before version 1.7.16, graphql-playground-middleware-koa before version 1.6.15, graphql-playground-middleware-lambda before version 1.7.17, and graphql-playground-middleware-hapi before 1.6.13.

Metrics

CVSS 3.1 7.4/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
prisma-labs	graphql-playground	< 1.6.22

References

https://github.com/prisma-labs/graphql-playground#security-detailsThird Party Advisory
https://github.com/prisma-labs/graphql-playground/commit/bf1883db538c97b076801a60677733816cb3cfb7Patch, Third Party Advisory
https://github.com/prisma-labs/graphql-playground/security/advisories/GHSA-4852-vrh7-28rfMitigation, Third Party Advisory
https://github.com/prisma-labs/graphql-playground#security-detailsThird Party Advisory
https://github.com/prisma-labs/graphql-playground/commit/bf1883db538c97b076801a60677733816cb3cfb7Patch, Third Party Advisory
https://github.com/prisma-labs/graphql-playground/security/advisories/GHSA-4852-vrh7-28rfMitigation, Third Party Advisory

Timeline

Published: Jun 8, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-40399.1SUSI.AI is an intelligent Open Source personal assistant. SUSI.AI Server before version d27ed0f has a directory traversal vulnerability due CVE-2020-40404.3Bolt CMS before version 3.7.1 lacked CSRF protection in the preview generating endpoint. Previews are intended to be generated by the admins CVE-2020-40416.1In Bolt CMS before version 3.7.1, the filename of uploaded files was vulnerable to stored XSS. It is not possible to inject javascript code CVE-2020-40426.8Bareos before version 19.2.8 and earlier allows a malicious client to communicate with the director without knowledge of the shared secret i CVE-2020-40439.8phpMussel from versions 1.0.0 and less than 1.6.0 has an unserialization vulnerability in PHP's phar wrapper. Uploading a specially crafted CVE-2020-40447.8The xrdp-sesman service before version 0.9.13.1 can be crashed by connecting over port 3350 and supplying a malicious payload. Once the xrdp CVE-2020-40457.5SSB-DB version 20.0.0 has an information disclosure vulnerability. The get() method is supposed to only decrypt messages when you explicitly CVE-2020-40465.4In affected versions of WordPress, users with low privileges (like contributors and authors) can use the embed block in a certain way to inj CVE-2020-40476.8In affected versions of WordPress, authenticated users with upload permissions (like authors) are able to inject JavaScript into some media CVE-2020-40485.7In affected versions of WordPress, due to an issue in wp_validate_redirect() and URL sanitization, an arbitrary external link can be crafted CVE-2020-40492.4In affected versions of WordPress, when uploading themes, the name of the theme folder can be crafted in a way that could lead to JavaScript CVE-2020-40503.1In affected versions of WordPress, misuse of the `set-screen-option` filter's return value allows arbitrary user meta fields to be saved. It