{"id":"GO-2026-5837","revision":"29cb441e3c994fd5a0a83bccdaeeeea9","records":[{"revision":"29cb441e3c994fd5a0a83bccdaeeeea9","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-5837","aliases":["CVE-2026-44840","GHSA-q2m9-6jp9-c6mc"],"title":"DQL injection via checkUserPassword GraphQL query in github.com/dgraph-io/dgraph","description":"The checkUserPassword GraphQL query in Dgraph is vulnerable to Dgraph Query Language (DQL) injection. User-supplied password values are interpolated directly into a DQL checkpwd query without escaping or parameterization. An attacker can inject a password containing a double-quote character to break out of the DQL string literal and append arbitrary DQL query blocks.","state":0,"publishedAt":"2026-07-07T15:26:32+00:00","modifiedAt":"2026-07-23T17:45:22.622665+00:00","affected":[{"ecosystem":"Go","name":"github.com/dgraph-io/dgraph","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/hypermodeinc/dgraph/v24","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/dgraph-io/dgraph/v25","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"25.3.4"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/dgraph-io/dgraph/security/advisories/GHSA-q2m9-6jp9-c6mc","https://github.com/dgraph-io/dgraph/commit/cee702c93f141eeb0c96a81f70830ec9e459efac","https://github.com/dgraph-io/dgraph/releases/tag/v25.3.4"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-5837","license":"OSV · upstream source license applies","key":"osv:GO-2026-5837","identifiers":["GO-2026-5837","CVE-2026-44840","GHSA-q2m9-6jp9-c6mc"]},"retained":false,"historicalAffected":[]}],"coverage":[]}