GO-2026-5749
DQL injection via unsanitized NQuad Lang field in github.com/dgraph-io/dgraph
Quick fix
GO-2026-5749 — github.com/dgraph-io/dgraph/v25: upgrade to the fixed version with the command below.
go get github.com/dgraph-io/dgraph/v25@v25.3.3Details
A vulnerability in Dgraph allows an unauthenticated attacker full read access to data in the database when ACL is not enabled.
The injection exploits the addQueryIfUnique function, which constructs DQL queries using fmt.Sprintf with an unsanitized predicate name that includes the raw Lang value from a JSON mutation key. An attacker can escape the function and inject arbitrary named query blocks, which execute server-side and return results in the HTTP response.
Are you affected?
Enter the version of the package you're using.
Affected packages
0 No fixed version published yet for github.com/dgraph-io/dgraph (go modules). Pin to a known-safe version or switch to an alternative.
0 Fixed in: 25.3.3 go get github.com/dgraph-io/dgraph/v25@v25.3.3 0 Fixed in: 24.1.9 go get github.com/hypermodeinc/dgraph/v24@v24.1.9