What is GHSA-9w87-4j72-gcv7?

GHSA-9w87-4j72-gcv7 is a security advisory published by GitHub Security Advisories with High severity. Insecure Default Configuration in graphql-code-generator

Why does GHSA-9w87-4j72-gcv7 have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

Which products are affected by GHSA-9w87-4j72-gcv7?

GHSA-9w87-4j72-gcv7 affects 1 product, including: npm/graphql-code-generator:\u003c 0.18.2.

GHSA-9w87-4j72-gcv7HighDisclosed before NVD

Insecure Default Configuration in graphql-code-generator

Vendor

GitHub Security Advisories

Published

September 2, 2020

Last Modified

January 9, 2023

📋 Description

Versions of graphql-code-generator prior to 0.18.2 have an Insecure Default Configuration. The packages sets NODE_TLS_REJECT_UNAUTHORIZED to 0, disabling certificate verification for the entire project. This results in Insecure Communication for the process.

Recommendation

Upgrade to version 0.18.2 or later.

🎯 Affected products1

npm/graphql-code-generator:< 0.18.2

🔗 References (3)

https://github.com/dotansimha/graphql-code-generator/issues/1806
https://www.npmjs.com/advisories/834
https://github.com/advisories/GHSA-9w87-4j72-gcv7