Executive brief
Genql is a code generator that creates type-safe GraphQL clients from schema definitions. Versions before 6.3.4 allow an authenticated attacker who can control the GraphQL schema input to inject malicious JavaScript or TypeScript code that executes automatically when the generated client is bundled and imported. This could lead to complete compromise of applications using the generated code.
Technical details
The vulnerability is a code injection flaw (CWE-116: Improper Encoding or Escaping of Output) in the Genql code generator. The root cause is insufficient sanitization or escaping of GraphQL schema input when generating the schema.ts output file. An authenticated attacker with access to provide or modify the GraphQL schema can inject arbitrary JavaScript or TypeScript code that will be embedded directly into generated code. When the genql client is bundled and imported by a downstream application, the injected code executes automatically in the application's context, providing the attacker with arbitrary code execution. Patches are available in version 6.3.4 and later.
Affected products
- remorses @genql/cli before 6.3.4
Timeline
- 2026-07-16: disclosed
- 2026-07-16: patched: Version 6.3.4 released with fix