Description

Dgraph is an open source distributed GraphQL database. Prior to 25.3.8, maybeQuoteArg in graphql/resolve/query_rewriter.go passes regexp filter strings into generated DQL without quoting or validating the /pattern/flags form, allowing crafted GraphQL query or mutation filters to inject DQL operators, disclose unintended nodes, or expand modification and deletion targets. This issue is fixed in version 25.3.8.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.6",
  "pubDate": "2026-08-06T22:18:12.330Z",
  "pubdate": "2026-08-06T22:18:12.330Z",
  "executiveSummary": "A security vulnerability exists in Dgraph prior to version 25.3.8, specifically involving improper neutralization of regular expression filter strings within the GraphQL query processing engine. Classified as an injection vulnerability, this flaw allows malicious actors to execute unauthorized DQL operations by crafting specific GraphQL queries or mutations with malicious filter payloads.\nThe primary impact of this vulnerability includes the unauthorized disclosure of unintended database nodes, as well as the potential expansion of modification and deletion targets beyond the intended scope of the original query or mutation.\nThe affected product is the open source distributed GraphQL database Dgraph, impacting all versions prior to 25.3.8. The risk implications are severe, as attackers possessing the ability to submit crafted GraphQL queries can manipulate the underlying database query logic without authorization.\nExploitation requires the capability to submit specially crafted GraphQL queries or mutations containing malicious regular expression patterns that leverage the /pattern/flags syntax. No specific complex preconditions are mentioned beyond interacting with the vulnerable GraphQL query interface.",
  "technicalDetails": "The root cause of the vulnerability resides in the maybeQuoteArg function located within the graphql/resolve/query_rewriter.go file of the Dgraph codebase. During the resolution of GraphQL queries, this function processes regular expression filter strings and passes them directly into the generated DQL (Dgraph Query Language) without applying proper quoting, escaping, or validation mechanisms against the /pattern/flags form.\nThe vulnerable component is the query rewriting module responsible for translating GraphQL query structures into underlying DQL statements. Affected versions include all Dgraph deployments prior to version 25.3.8. The vulnerability allows an unauthenticated or authenticated user capable of issuing GraphQL requests to supply specially crafted input that breaks out of the intended regular expression context.\nThe attack flow proceeds as follows: 1. The attacker crafts a malicious GraphQL query or mutation containing a filter string designed to exploit the lack of input sanitization. 2. The Dgraph server receives the GraphQL request and invokes graphql/resolve/query_rewriter.go to translate the query into DQL. 3. The maybeQuoteArg function fails to properly quote or validate the supplied regular expression filter string adhering to the /pattern/flags form. 4. The raw, unsanitized filter string is concatenated or interpolated directly into the generated DQL query structure. 5. The injected DQL operators alter the intended syntax and semantics of the database query. 6. The database executes the modified DQL query, resulting in unintended node disclosures or unauthorized execution of expanded data modification and deletion targets.\nPost-exploitation impact encompasses data exfiltration via unauthorized node disclosure and data integrity compromise through unauthorized expansion of write, update, or delete operations."
}