CVE-2026-63397: remorses/genql code injection

Severity: medium (CVSS 6.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-16 · updated 2026-10-24
Weakness: CWE-116

Description

remorses/genql before version 6.3.4 allows an authenticated attacker with control of the GraphQL schema that is passed to genql to inject arbitrary JavaScript or TypeScript. The malicious code is injected into the generated schema.ts file and executes when the genql client is bundled and imported.

Affected products

remorses genql: before 6.3.4 — fixed in 6.3.4

How to fix

Upgrade to a fixed version: remorses genql 6.3.4. Check the vendor advisory for mitigations.

References

https://github.com/remorses/genql
https://github.com/remorses/genql/releases/tag/%40genql%2Fcli%406.3.4
https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-197-01.json
https://www.cve.org/CVERecord?id=CVE-2026-63397

Get alerted when CVE-2026-63397 or the next vulnerability affects your stack