CVE-2021-41248

CVE-2021-41248 is a dynamic Cross-Site Scripting (XSS) vulnerability affecting GraphiQL versions older than 1.4.7, where malicious GraphQL type names in schema introspection responses or schema prop values can lead to code injection during operation autocomplete. The attack requires a user to load a vulnerable schema, which is more readily exploitable in custom GraphiQL implementations allowing dynamic schema URL configuration. Rated Medium (CVSS 4.7), the attack has high complexity and requires user interaction, but can result in partial loss of confidentiality and integrity. There is no evidence of active exploitation, public exploit code, or significant community discussion surrounding this vulnerability.