CVE-2024-24556 is a Cross-Site Scripting (XSS) vulnerability affecting the @urql/next package within the urql GraphQL client. This flaw allows an attacker to inject malicious scripts if the web application uses streamed responses (non-RSC) and the GraphQL response contains unescaped HTML tags. The vulnerability is rated as MEDIUM severity (CVSS 6.1), requiring user interaction and network access for exploitation, with potential impacts on confidentiality and integrity. There is currently no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 1.1.1CPE matchmatch criteria | cpe:2.3:a:nearform:urql:*:*:*:*:*:node.js:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.