AIKIDO-2026-674260
graphiti is vulnerable to Information Disclosure
75
High Risk
This Affects:
graphitiTL;DR
Graphiti resources expose a stats[group_by] parameter that accepts a client supplied attribute name. Unlike filter, sort, and fields, the grouping key is passed to the ActiveRecord adapter's grouping without checking it against the resource's readable attributes. A caller can group on any column of the backing table, including undeclared columns and attributes declared non-readable, and read back their distinct values such as password reset tokens. The fix validates the group key against the resource's readable policy and rejects unknown or unreadable attributes.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you expose a resource whose adapter supports stats[group_by] grouping.
Background info
graphiti is vulnerable to Information Disclosure in versions 1.3.9 - 1.13.4 and 2.0.0 - 2.0.1.
How to fix this
Upgrade the graphiti library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.