Executive brief
graphql-code-generator is a development tool that generates TypeScript and JavaScript code from GraphQL schemas. Versions prior to 0.18.2 disable SSL/TLS certificate verification for the entire process by setting NODE_TLS_REJECT_UNAUTHORIZED to 0, making all HTTPS connections vulnerable to man-in-the-middle attacks. An attacker on the network could intercept and modify API calls, potentially compromising credentials, API keys, or injecting malicious code during the code generation process.
Technical details
This vulnerability stems from an insecure default configuration where the package explicitly sets the NODE_TLS_REJECT_UNAUTHORIZED environment variable to 0, disabling SSL/TLS certificate verification globally for the entire Node.js process. The vulnerability affects all versions prior to 0.18.2 and is exploitable by any attacker positioned to perform network-level interception (man-in-the-middle). The attack requires network access to intercept HTTPS traffic but does not require authentication or user interaction. An attacker can intercept and modify traffic between the code generator and any remote GraphQL endpoints or package registries. The vulnerability was fixed in version 0.18.2 by removing the insecure environment variable setting.
Affected products
- graphql-code-generator graphql-code-generator prior to 0.18.2
Timeline
- 2019-05-02: disclosed: Security issue reported on GitHub
- 2020-09-02: patched: GHSA advisory published; fix available in version 0.18.2