Vulnerability PYSEC-2026-2282
Medium Risk
MEDIUM RISK
CVSS Score: 4.3
Score Range: 4.0–6.9
Medium severity vulnerabilities (CVSS 4.0–6.9). Important issues that meaningfully reduce security confidence.
4 months ago
June 04, 2026 at 03:16 PM UTC
No summary available
0.288.4 - 0.315.3
0.288.4 - 0.315.3
Details
Strawberry GraphQL is a library for creating GraphQL APIs. In versions 0.288.4 through 0.315.3, Strawberry's bundled GraphiQL template wrote values from the GraphiQL headers editor into the browser URL query string. If a user entered a sensitive header, such as Authorization: Bearer <token>, the value could become visible in browser history, copied links, and server/proxy/CDN access logs after a page reload or shared request. Version 0.315.4 patches the issue.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Low Risk
6 hours ago
Strawberry legacy graphql-ws retains naturally completed subscription slots
0.312.3 - 0.327.1 GHSA-m952-2w3f-6r8h
0.312.3 - 0.327.1 GHSA-m952-2w3f-6r8h
High Risk
6 hours ago
Strawberry GraphQL: Synchronous permission checks can treat an awaitable authorization result as truthy
0.217.0 - 0.326.0 GHSA-pfvf-fwfp-25mp
0.217.0 - 0.326.0 GHSA-pfvf-fwfp-25mp
Low Risk
3 months ago
Strawberry GraphQL has type resolution vulnerability in node interface that allows potential data leakage through incorrect type resolution
0.182.0 - 0.257.0.dev1735244504 PYSEC-2026-1946
0.182.0 - 0.257.0.dev1735244504 PYSEC-2026-1946
Medium Risk
4 months ago
No summary available
0.172.0 - 0.315.6 PYSEC-2026-2284
0.172.0 - 0.315.6 PYSEC-2026-2284
Medium Risk
4 months ago
No summary available
0.71.0 - 0.315.6 PYSEC-2026-2283
0.71.0 - 0.315.6 PYSEC-2026-2283
Impacted packages
Timeline
Published
4 months ago
June 04, 2026 at 03:16 PM UTC
Fixed (0.315.4)
5 months ago
May 12, 2026 at 06:35 PM UTC
Last Modified
2 months ago
July 13, 2026 at 07:15 AM UTC