A GraphQL field injection vulnerability was detected. The server processed a crafted GraphQL query containing an injected numeric expression and reflected the result in the response, indicating that user-controlled input influences query execution in an unsafe way.

GraphQL endpoints that do not properly validate or sanitize incoming query structures may be exploited to access unauthorized data, bypass authorization, or cause unintended server-side behavior.

Impacts:

• Unauthorized access to fields or types not intended to be publicly exposed
• Bypass of field-level authorization checks
• Potential for data exfiltration via aliased or nested field queries
• Server-side denial of service through deeply nested or expensive queries

Recommendation:

• Implement strict query depth and complexity limits
• Enforce field-level authorization in resolvers
• Disable or restrict alias usage where not required
• Validate and allowlist accepted query structures
• Use a Web Application Firewall (WAF) with GraphQL-aware rules

• GraphQL Security Cheat Sheet
• GraphQL Injection