PyPIPackage

strawberry-graphql

9 known vulnerabilities (3 high, 3 medium, 3 low), with the versions each affects and the releases that fix them.

Latest release: 0.341.2 (Nov 7, 2026): no advisory affects it
Newest unaffected release: 0.341.2 (Nov 7, 2026), the latest release
Advisories: 9 · 3 high, 3 medium, 3 low

Weekly downloads: 1.5M
Dependents: 170
Releases: 500+ since 0.176.2 (May 2, 2023)
Registry: PyPI
Releases read: Nov 8, 2026

Version timeline

CVE-2026-107728
Affects 0.217.0 to 0.326.0 (0.326.1 is outside it)
CVE-2026-107727
Affects 0.312.3 to 0.327.1 (0.327.2 is outside it)
CVE-2026-47707
Affects 0.176.2 to 0.315.6 (0.315.7 is outside it)
CVE-2026-45739
Affects 0.288.4 to 0.315.3 (0.315.4 is outside it)
CVE-2026-47706
Affects 0.176.2 to 0.315.6 (0.315.7 is outside it)
CVE-2026-35523
Affects 0.176.2 to 0.312.2 (0.312.3 is outside it)
CVE-2026-35526
Affects 0.176.2 to 0.312.2 (0.312.3 is outside it)
CVE-2025-22151
Affects 0.182.0 to 0.257.0.dev1735244504 (0.257.0 is outside it)
CVE-2024-47082
Affects 0.176.2 to 0.242.0 (0.243.0 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects. Older releases aren't stored, so the earliest spans may start sooner.

Advisories 9

CVE-2026-107728High 7.5
Strawberry GraphQL: Synchronous permission checks can treat an awaitable authorization result as truthy
Affected: from 0.217.0, fixed in 0.326.1.
Fixed in 0.326.1 (released Aug 31, 2026, 38 days before disclosure).
The latest release, 0.341.2, is not affected.
CVE-2026-107727Low 3.7
Strawberry legacy graphql-ws retains naturally completed subscription slots
Affected: from 0.312.3, fixed in 0.327.2.
Fixed in 0.327.2 (released Sep 3, 2026, 35 days before disclosure).
The latest release, 0.341.2, is not affected.
CVE-2026-47707Medium 5.3
Strawberry GraphQL's Bypass of MaxAliasesLimiter via Fragment Spreads leading to GraphQL Alias Amplification
Affected: from 0.172.0, fixed in 0.315.7.
Fixed in 0.315.7 (released May 19, 2026, 16 days before disclosure).
The latest release, 0.341.2, is not affected.
CVE-2026-45739Low 3.1
Strawberry GraphQL: Default GraphiQL may expose HTTP headers in URLs
Affected: from 0.288.4, fixed in 0.315.4.
Fixed in 0.315.4 (released May 12, 2026, 23 days before disclosure).
The latest release, 0.341.2, is not affected.
CVE-2026-47706Medium 5.3
Strawberry GraphQL has a Circular Fragment Reference DOS
Affected: from 0.71.0, fixed in 0.315.7.
Fixed in 0.315.7 (released May 19, 2026, 16 days before disclosure).
The latest release, 0.341.2, is not affected.
CVE-2026-35523High 7.5
Authentication bypass in strawberry-graphql via legacy graphql-ws WebSocket subprotocol
Affected: fixed in 0.312.3.
Fixed in 0.312.3 (released Apr 4, 2026, 3 days before disclosure).
The latest release, 0.341.2, is not affected.
CVE-2026-35526High 7.5
Strawberry GraphQL affected by a Denial of Service via unbounded WebSocket subscriptions
Affected: fixed in 0.312.3.
Fixed in 0.312.3 (released Apr 4, 2026, 3 days before disclosure).
The latest release, 0.341.2, is not affected.
CVE-2025-22151Low 3.7
Strawberry GraphQL has a type resolution vulnerability
Affected: from 0.182.0, fixed in 0.257.0.
Fixed in 0.257.0 (released Jan 9, 2025, the day of disclosure).
The latest release, 0.341.2, is not affected.
CVE-2024-47082Medium 4.6
Strawberry GraphQL Cross-Site Request Forgery (CSRF) vulnerability
Affected: fixed in 0.243.0.
Fixed in 0.243.0 (released Sep 25, 2024, the day of disclosure).
The latest release, 0.341.2, is not affected.