{"id":"CVE-2026-63637","aliases":["EUVD-2026-54255","GHSA-33p8-wc97-5qcj"],"status":"published","title":"Dgraph: DQL Injection via unvalidated regexp filter argument in GraphQL query rewriter","description":"Dgraph is an open source distributed GraphQL database. Prior to 25.3.8, maybeQuoteArg in graphql/resolve/query_rewriter.go passes regexp filter strings into generated DQL without quoting or validating the /pattern/flags form, allowing crafted GraphQL query or mutation filters to inject DQL operators, disclose unintended nodes, or expand modification and deletion targets. This issue is fixed in version 25.3.8.","severity":{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00408,"percentile":0.35535,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-943"],"published":"2026-08-06T20:20:32Z","modified":"2026-10-28T02:30:50Z","products":[{"vendor":"dgraph-io","product":"dgraph"}],"references":[{"url":"https://github.com/dgraph-io/dgraph/security/advisories/GHSA-33p8-wc97-5qcj","tags":["x_refsource_CONFIRM","advisory"]},{"url":"https://github.com/dgraph-io/dgraph/commit/aaff09ab9608f87d88e9d601e71d271306083392","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63637.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63637","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-63637","title":"Dgraph: DQL Injection via unvalidated regexp filter argument in GraphQL query rewriter","description":"Dgraph is an open source distributed GraphQL database. Prior to 25.3.8, maybeQuoteArg in graphql/resolve/query_rewriter.go passes regexp filter strings into generated DQL without quoting or validating the /pattern/flags form, allowing crafted GraphQL query or mutation filters to inject DQL operators, disclose unintended nodes, or expand modification and deletion targets. This issue is fixed in version 25.3.8.","status":"published","published":"2026-08-06T20:20:32.352Z","modified":"2026-08-07T16:54:23.924Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","level":"high","assessor":"cna"}],"cwes":["CWE-943"],"updated_at":"2026-11-02T14:19:56.284359Z"}],"euvd":[{"id":"EUVD-2026-54255","description":"Dgraph is an open source distributed GraphQL database. Prior to 25.3.8, maybeQuoteArg in graphql/resolve/query_rewriter.go passes regexp filter strings into generated DQL without quoting or validating the /pattern/flags form, allowing crafted GraphQL query or mutation filters to inject DQL operators, disclose unintended nodes, or expand modification and deletion targets. This issue is fixed in version 25.3.8.","status":"published","published":"2026-08-06T20:20:32Z","modified":"2026-08-07T16:54:23Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T18:02:06.930016Z"}],"nvd":[{"id":"CVE-2026-63637","description":"Dgraph is an open source distributed GraphQL database. Prior to 25.3.8, maybeQuoteArg in graphql/resolve/query_rewriter.go passes regexp filter strings into generated DQL without quoting or validating the /pattern/flags form, allowing crafted GraphQL query or mutation filters to inject DQL operators, disclose unintended nodes, or expand modification and deletion targets. This issue is fixed in version 25.3.8.","status":"published","published":"2026-08-06T22:18:12.33Z","modified":"2026-10-24T16:10:00.153Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","level":"high","assessor":"secondary"}],"cwes":["CWE-943"],"updated_at":"2026-11-02T14:12:35.386166Z"}],"osv":[{"id":"CVE-2026-63637","title":"Dgraph: DQL Injection via unvalidated regexp filter argument in GraphQL query rewriter","description":"Dgraph is an open source distributed GraphQL database. Prior to 25.3.8, maybeQuoteArg in graphql/resolve/query_rewriter.go passes regexp filter strings into generated DQL without quoting or validating the /pattern/flags form, allowing crafted GraphQL query or mutation filters to inject DQL operators, disclose unintended nodes, or expand modification and deletion targets. This issue is fixed in version 25.3.8.","status":"published","published":"2026-08-06T20:20:32.352Z","modified":"2026-10-28T02:30:50.542280427Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","level":"high"}],"cwes":["CWE-943"],"updated_at":"2026-11-02T15:45:13.306117Z"}]}}