What is CVE-2026-63397?

CVE-2026-63397 is a medium-severity vulnerability in Remorses Genql, classified under Improper Encoding or Escaping of Output. CVSS score: 6.4/10. Published 2026-07-16.

How severe is CVE-2026-63397?

Medium severity. CVSS v3 base score is 6.4 out of 10.

Vulnerability in Remorses Genql

CVE-2026-63397

remorses/genql before version 6.3.4 allows an authenticated attacker with control of the GraphQL schema that is passed to genql to inject arbitrary JavaScript or TypeScript. The malicious code is injected into the generated schema.ts file…

CVSS v3 metric

CVSS v3 base score 6.4 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H.

Affected products

Remorses Genql — versions 0, 6.3.4

Weakness classification (CWE)

CWE-116 — Improper Encoding or Escaping of Output

References

9119a7d8-5eab-497f-8521-727c672e3725 (patch)
9119a7d8-5eab-497f-8521-727c672e3725 (vdb-entry)
9119a7d8-5eab-497f-8521-727c672e3725 (product)
9119a7d8-5eab-497f-8521-727c672e3725 (third-party-advisory)

Frequently asked questions

What is CVE-2026-63397?: CVE-2026-63397 is a medium-severity vulnerability in Remorses Genql, classified under Improper Encoding or Escaping of Output. CVSS score: 6.4/10. Published 2026-07-16.
How severe is CVE-2026-63397?: Medium severity. CVSS v3 base score is 6.4 out of 10.