github.com/dgraph-io/dgraph/v25
Built from the advisories that name this package: its registry metadata (versions, licence, dependencies) has not been fetched by this service yet.
At a glance
- Ecosystem
- Go
- Vulnerability status
- 15 advisory(ies) without a verdict
Advisories (15)
| Advisory | Affected versions | Latest version |
|---|---|---|
| GHSA-95mq-xwj4-r47p Dgraph: Unauthenticated /debug/pprof/cmdline discloses admin auth token, enabling unauthorized access to protected Alpha admin endpoints | < 25.3.2 | Undetermined |
| GHSA-mrxx-39g5-ph77 Dgraph: Pre-Auth Full Database Exfiltration via DQL Injection in Upsert Condition Field | < 25.3.3 | Undetermined |
| GHSA-p5rh-vmhp-gvcw Dgraph: Pre-Auth Database Overwrite + SSRF + File Read via restoreTenant Missing Authorization | < 25.3.1 | Undetermined |
| GHSA-q2m9-6jp9-c6mc Dgraph Vulnerable to DQL Injection via checkUserPassword GraphQL Query | < 25.3.4 | Undetermined |
| GHSA-qj98-gp63-54xj Dgraph: Zero Unauthenticated HTTP Admin removeNode Denial of Service | < 25.4.0 | Undetermined |
| GHSA-rrwh-6jrq-wp5v Dgraph Alpha group stores can be replaced via unauthenticated external snapshot import | < 25.3.5 | Undetermined |
| GHSA-vvf7-6rmr-m29q Dgraph: Unauthenticated Admin Token Disclosure Leading to Authentication Bypass via /debug/vars | < 25.3.3 | Undetermined |
| GHSA-x92x-px7w-4gx4 Dgraph: Pre-Auth Full Database Exfiltration via DQL Injection in NQuad Lang Field | < 25.3.3 | Undetermined |
| GO-2026-5274 Dgraph: Unauthenticated admin token disclosure via /debug/pprof/cmdline in github.com/dgraph-io/dgraph | < 25.3.2 | Undetermined |
| GO-2026-5516 Pre-Auth DQL injection in upsert condition field in github.com/dgraph-io/dgraph | < 25.3.3 | Undetermined |
| GO-2026-5529 Unauthenticated restoreTenant mutation allows database overwrite and SSRF in github.com/dgraph-io/dgraph | < 25.3.1 | Undetermined |
| GO-2026-5675 Unauthenticated admin token disclosure via /debug/vars in github.com/dgraph-io/dgraph | < 25.3.3 | Undetermined |
| GO-2026-5749 DQL injection via unsanitized NQuad Lang field in github.com/dgraph-io/dgraph | < 25.3.3 | Undetermined |
| GO-2026-5837 DQL injection via checkUserPassword GraphQL query in github.com/dgraph-io/dgraph | < 25.3.4 | Undetermined |
| GO-2026-6261 Dgraph Alpha group stores can be replaced via unauthenticated external snapshot import in github.com/dgraph-io/dgraph | < 25.3.5 | Undetermined |
Sources
| Source | Licence |
|---|