CVE-2026-63637 · Symaro Security Advisory

Description

Dgraph is an open source distributed GraphQL database. Prior to 25.3.8, maybeQuoteArg in graphql/resolve/query_rewriter.go passes regexp filter strings into generated DQL without quoting or validating the /pattern/flags form, allowing crafted GraphQL query or mutation filters to inject DQL operators, disclose unintended nodes, or expand modification and deletion targets. This issue is fixed in version 25.3.8.

Severity (CVSS)

Base score	8.6
Severity	High
Version	CVSS 3.1
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Provided by	CNA

Weaknesses

CWE-943 — CWE-943: Improper Neutralization of Special Elements in Data Query Logic

Affected products

Vendor	Product	Versions
dgraph-io	dgraph	< 25.3.8

References

https://github.com/dgraph-io/dgraph/security/advisories/GHSA-33p8-wc97-5qcj (x_refsource_CONFIRM)
https://github.com/dgraph-io/dgraph/commit/aaff09ab9608f87d88e9d601e71d271306083392 (x_refsource_MISC)

Authoritative sources

This page is a snapshot. For the latest enrichment and updates, view the record on CVE.org or the NVD.

Generated from the official CVE List on 07 Aug 2026 07:02 UTC.