What’s Vulnerable › Vulnerabilities

CVE-2020-4038: Reflected XSS in GraphQL Playground

• Severity: high (CVSS 7.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 7.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-06-08 · updated 2026-06-17
• Weakness: CWE-79

Description

GraphQL Playground (graphql-playground-html NPM package) before version 1.6.22 have a severe XSS Reflection attack vulnerability. All unsanitized user input passed into renderPlaygroundPage() method could trigger this vulnerability. This has been patched in graphql-playground-html version 1.6.22. Note that some of the associated dependent middleware packages are also affected including but not limited to graphql-playground-middleware-express before version 1.7.16, graphql-playground-middleware-koa before version 1.6.15, graphql-playground-middleware-lambda before version 1.7.17, and graphql-playground-middleware-hapi before 1.6.13.

Affected products

• prisma Graphql-Playground-Html: before 1.6.22 — fixed in 1.6.22
• prisma Graphql-Playground-Middleware-Express: before 1.7.16 — fixed in 1.7.16
• prisma Graphql-Playground-Middleware-Hapi: before 1.6.13 — fixed in 1.6.13
• prisma Graphql-Playground-Middleware-Koa: before 1.6.15 — fixed in 1.6.15
• prisma Graphql-Playground-Middleware-Lambda: before 1.7.17 — fixed in 1.7.17

How to fix

Upgrade to a fixed version: prisma Graphql-Playground-Html 1.6.22; prisma Graphql-Playground-Middleware-Express 1.7.16; prisma Graphql-Playground-Middleware-Hapi 1.6.13; prisma Graphql-Playground-Middleware-Koa 1.6.15; prisma Graphql-Playground-Middleware-Lambda 1.7.17. Check the vendor advisory for mitigations.

References

• https://github.com/prisma-labs/graphql-playground#security-details
• https://github.com/prisma-labs/graphql-playground/commit/bf1883db538c97b076801a60677733816cb3cfb7
• https://github.com/prisma-labs/graphql-playground/security/advisories/GHSA-4852-vrh7-28rf
• https://github.com/prisma-labs/graphql-playground#security-details
• https://github.com/prisma-labs/graphql-playground/commit/bf1883db538c97b076801a60677733816cb3cfb7
• https://github.com/prisma-labs/graphql-playground/security/advisories/GHSA-4852-vrh7-28rf

Get alerted when CVE-2020-4038 or the next vulnerability affects your stack