jaydenseric / graphql-upload

Middleware and an Upload scalar to add support for GraphQL multipart requests (file uploads via queries and mutations) to various Node.js GraphQL servers.
https://npm.im/graphql-upload
MIT License
1.43k stars 131 forks source link

Vulnerability in object-path #265

Closed baboulebou closed 2 years ago

baboulebou commented 2 years ago

There is a prototype pollution vulnerability in object-path that is fixed in 0.11.8. That dependency needs to be updated in graphql-upload. See: https://github.com/mariocasciaro/object-path

jaydenseric commented 2 years ago

See https://github.com/jaydenseric/graphql-upload/issues/261#issuecomment-915846860 .