diff --git a/vulnerabilities/AIKIDO-2025-10015.json b/vulnerabilities/AIKIDO-2025-10015.json new file mode 100644 index 0000000..3cc6203 --- /dev/null +++ b/vulnerabilities/AIKIDO-2025-10015.json @@ -0,0 +1,26 @@ +{ + "package_name": "strawberry-graphql", + "patch_versions": [ + "0.257.0" + ], + "vulnerable_ranges": [ + [ + "0.43.0", + "0.256.1" + ] + ], + "cwe": [ + "CWE-497" + ], + "tldr": "Affected versions of this package are affected by an insecure validation when handling objects from integrations such as Django, SQLAlchemy, or Pydantic. When these objects are received in a format that closely resembles the expected type, it can result in `is_type_of` checks incorrectly identifying the type. An attacker could exploit this misclassification to force the application to return critical data, resulting in Information Disclosure.", + "doest_this_affect_me": "You are affected if you are using a version that falls within the vulnerable range.", + "how_to_fix": "Upgrade the `strawberry-graphql` library to the patch version.", + "vulnerable_to": "Information Disclosure", + "related_cve_id": "", + "language": "python", + "severity_class": "MEDIUM", + "aikido_score": 58, + "changelog": "https://github.com/strawberry-graphql/strawberry/releases/tag/0.257.0", + "last_modified": "2025-01-09", + "published": "2025-01-09" +}