LOW3.7PyPI
GHSA-5xh2-23cc-5jc6· CVE-2025-22151, PYSEC-2026-1946Strawberry GraphQL has type resolution vulnerability in node interface that allows potential data leakage through incorrect type resolution
Modified: 7/7/2026
package
PyPI/strawberry-graphql
pkg:pypi/strawberry-graphql
MEDIUM4.6PyPI
GHSA-79gp-q4wv-33fr· CVE-2024-47082, PYSEC-2024-171Cross-Site Request Forgery (CSRF) in strawberry-graphql
Modified: 1/21/2025
MEDIUM5.3PyPI
GHSA-fr49-mhgj-crfc· CVE-2026-47707, PYSEC-2026-2284Strawberry GraphQL's Bypass of MaxAliasesLimiter via Fragment Spreads leading to GraphQL Alias Amplification
Modified: 7/13/2026
HIGH7.5PyPI
GHSA-hv3w-m4g2-5x77· CVE-2026-35526, PYSEC-2026-134strawberry-graphql: Denial of Service via unbounded WebSocket subscriptions
Modified: 6/8/2026
MEDIUM5.3PyPI
GHSA-qfwv-87qj-98xq· CVE-2026-47706, PYSEC-2026-2283Strawberry GraphQL has a Circular Fragment Reference DOS
Modified: 7/13/2026
HIGH7.5PyPI
GHSA-vpwc-v33q-mq89· CVE-2026-35523, PYSEC-2026-133strawberry-graphql: Authentication bypass via legacy graphql-ws WebSocket subprotocol
Modified: 6/8/2026
LOW3.1PyPI
GHSA-x97m-qp5c-w9xj· CVE-2026-45739, PYSEC-2026-2282Strawberry GraphQL: Default GraphiQL may expose HTTP headers in URLs
Modified: 7/13/2026
HIGH8.0PyPI
PYSEC-2024-171· CVE-2024-47082, GHSA-79gp-q4wv-33frModified: 1/18/2025
HIGH7.5PyPI
PYSEC-2026-133· CVE-2026-35523, GHSA-vpwc-v33q-mq89Modified: 5/20/2026
HIGH7.5PyPI
PYSEC-2026-134· CVE-2026-35526, GHSA-hv3w-m4g2-5x77Modified: 5/20/2026
LOW3.7PyPI
PYSEC-2026-1946· CVE-2025-22151, GHSA-5xh2-23cc-5jc6Strawberry GraphQL has type resolution vulnerability in node interface that allows potential data leakage through incorrect type resolution
Modified: 7/7/2026
MEDIUM4.3PyPI
PYSEC-2026-2282· CVE-2026-45739, GHSA-x97m-qp5c-w9xjModified: 7/13/2026
MEDIUM5.3PyPI
PYSEC-2026-2283· CVE-2026-47706, GHSA-qfwv-87qj-98xqModified: 7/13/2026
MEDIUM5.3PyPI
PYSEC-2026-2284· CVE-2026-47707, GHSA-fr49-mhgj-crfcModified: 7/13/2026