Medium
6.0
GraphQL Tools: Shared legacy executor routes one subscription's results to a different caller
CVE-2026-118666
First seen on SecPulse
Affected packages
| Ecosystem | Package | Affected | Fixed |
|---|---|---|---|
| ardatan | graphql-tools | — | — |
| @graphql-tools | executor-legacy-ws | — | — |
| npm | @graphql-tools/executor-legacy-ws |
< 1.1.36 |
1.1.36 |
Original description The description as published by the source.
Cross-tenant subscription data leak in @graphql-tools/executor-legacy-ws: a shared websocket.onmessage is replaced on every subscribe(), and DATA frames are delivered without checking the protocol operation id
Report metadata
| Field | Value |
|---|---|
| Package | @graphql-tools/executor-legacy-ws (npm, pkg:npm/%40graphql-tools/executor-legacy-ws) |
| Repository | https://github.com/ardatan/graphql-tools |
| Component | buildWSLegacyExecutor → the returned executor's subscribe(observer) / websocket.onmessage handler |
| Vulnerability class | Cross-tenant data leak (subscription results delivered to the wrong caller) |
| Verified against | Source at b5d1c36ebb8ed3868260ffee5bbcbb423ad5c1f1 (package version 1.1.33); published npm tarball 1.1.33 with matching source at d304214db06e8a4ce9cb41138f199e3bc6ed36f2; the same behaviour also reproduces on the current release 1.1.35 |
| API surface | Public documented API (buildWSLegacyExecutor) |
| Affected in default configuration | Yes — ensureWebsocket() reuses an already-OPEN socket (index.ts:35-42), and the socket has a single mutable onmessage property (index.ts:113). No single-operation-only restriction is documented, and the return type is the general reusable DisposableExecutor (packages/utils/src/executor.ts:34-57) |
Affected version range: the range recorded for this finding is <= 1.1.33, but that is understated — the same proof of concept reproduces on 1.1.35, and a…
Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory