Intel

AIKIDO-2025-10015

strawberry-graphql is vulnerable to Information Disclosure

Information DisclosureCVE-2025-22151 Published Jan 9, 2025

40

Medium Risk

This Affects:

pythonstrawberry-graphql
0.43.0 - 0.256.1
Fixed in 0.257.0
Are you affected? Scan for Free

TL;DR

Affected versions of this package are affected by an insecure validation when handling objects from integrations such as Django, SQLAlchemy, or Pydantic. When these objects are received in a format that closely resembles the expected type, it can result in is_type_of checks incorrectly identifying the type. An attacker could exploit this misclassification to force the application to return critical data, resulting in Information Disclosure.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range.

Background info

strawberry-graphql is vulnerable to Information Disclosure in versions 0.43.0 - 0.256.1.

How to fix this

Upgrade the strawberry-graphql library to the patch version.