AIKIDO-2025-10129
graphweaver is vulnerable to Insertion of Sensitive Information into Log File
35
Low Risk
This Affects:
graphweaverTL;DR
Affected versions of the package expose sensitive information in log files due to an insufficient mechanism for obfuscating sensitive argument values in authentication-related mutations. This issue affects multiple authentication methods, potentially leading to unauthorized access if log files are compromised.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
graphweaver is vulnerable to Insertion of Sensitive Information into Log File in versions 0.1.18 - 2.12.1.
How to fix this
Upgrade the graphweaver library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant