Executive brief
@urql/next is a GraphQL client library for Next.js applications that handles server-side data fetching. The library fails to properly escape HTML-like characters when streaming responses from GraphQL servers, allowing attackers to inject malicious scripts that execute in users' browsers. This could lead to session hijacking, credential theft, or unauthorized actions performed on behalf of users.
Technical details
The vulnerability is a Cross-site Scripting (XSS) flaw (CWE-79) stemming from improper escaping of HTML-like characters in the response stream handling. The attack requires the GraphQL response to contain HTML tags and the web application to use streamed responses (non-RSC mode). An unauthenticated network attacker can exploit this by controlling the GraphQL response content, achieving arbitrary script execution in the context of the user's browser. The vulnerability is fixed in version 1.1.1.
Affected products
- The URQL Project @urql/next < 1.1.1
Timeline
- 2024-01-30: disclosed
- 2024-01-30: patched: Version 1.1.1 released