# strawberry-graphql (PyPI) vulnerabilities 9 known vulnerabilities (3 high, 3 medium, 3 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 0.341.2 (Nov 7, 2026): no advisory affects it - Newest unaffected release: 0.341.2 (Nov 7, 2026), the latest release - Weekly downloads: 1.5M - Dependents: 170 - Releases: 500+ since 0.176.2 (May 2, 2023) - Registry: https://pypi.org/project/strawberry-graphql/ - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-107728: 0.217.0 to 0.326.0 (0.326.1 is outside it) - CVE-2026-107727: 0.312.3 to 0.327.1 (0.327.2 is outside it) - CVE-2026-47707: 0.176.2 to 0.315.6 (0.315.7 is outside it) - CVE-2026-45739: 0.288.4 to 0.315.3 (0.315.4 is outside it) - CVE-2026-47706: 0.176.2 to 0.315.6 (0.315.7 is outside it) - CVE-2026-35523: 0.176.2 to 0.312.2 (0.312.3 is outside it) - CVE-2026-35526: 0.176.2 to 0.312.2 (0.312.3 is outside it) - CVE-2025-22151: 0.182.0 to 0.257.0.dev1735244504 (0.257.0 is outside it) - CVE-2024-47082: 0.176.2 to 0.242.0 (0.243.0 is outside it) Older releases aren't stored, so the earliest spans may start sooner. ## Advisories (9) ### [CVE-2026-107728](https://cve.now/CVE-2026-107728): Strawberry GraphQL: Synchronous permission checks can treat an awaitable authorization result as truthy - Severity: High 7.5 - Published: Oct 8, 2026 - Affected: from 0.217.0, fixed in 0.326.1. - Fixed in 0.326.1 (released Aug 31, 2026, 38 days before disclosure). - The latest release, 0.341.2, is not affected. ### [CVE-2026-107727](https://cve.now/CVE-2026-107727): Strawberry legacy graphql-ws retains naturally completed subscription slots - Severity: Low 3.7 - Published: Oct 8, 2026 - Affected: from 0.312.3, fixed in 0.327.2. - Fixed in 0.327.2 (released Sep 3, 2026, 35 days before disclosure). - The latest release, 0.341.2, is not affected. ### [CVE-2026-47707](https://cve.now/CVE-2026-47707): Strawberry GraphQL's Bypass of MaxAliasesLimiter via Fragment Spreads leading to GraphQL Alias Amplification - Severity: Medium 5.3 - Published: Jun 4, 2026 - Affected: from 0.172.0, fixed in 0.315.7. - Fixed in 0.315.7 (released May 19, 2026, 16 days before disclosure). - The latest release, 0.341.2, is not affected. ### [CVE-2026-45739](https://cve.now/CVE-2026-45739): Strawberry GraphQL: Default GraphiQL may expose HTTP headers in URLs - Severity: Low 3.1 - Published: Jun 4, 2026 - Affected: from 0.288.4, fixed in 0.315.4. - Fixed in 0.315.4 (released May 12, 2026, 23 days before disclosure). - The latest release, 0.341.2, is not affected. ### [CVE-2026-47706](https://cve.now/CVE-2026-47706): Strawberry GraphQL has a Circular Fragment Reference DOS - Severity: Medium 5.3 - Published: Jun 4, 2026 - Affected: from 0.71.0, fixed in 0.315.7. - Fixed in 0.315.7 (released May 19, 2026, 16 days before disclosure). - The latest release, 0.341.2, is not affected. ### [CVE-2026-35523](https://cve.now/CVE-2026-35523): Authentication bypass in strawberry-graphql via legacy graphql-ws WebSocket subprotocol - Severity: High 7.5 - Published: Apr 7, 2026 - Affected: fixed in 0.312.3. - Fixed in 0.312.3 (released Apr 4, 2026, 3 days before disclosure). - The latest release, 0.341.2, is not affected. ### [CVE-2026-35526](https://cve.now/CVE-2026-35526): Strawberry GraphQL affected by a Denial of Service via unbounded WebSocket subscriptions - Severity: High 7.5 - Published: Apr 7, 2026 - Affected: fixed in 0.312.3. - Fixed in 0.312.3 (released Apr 4, 2026, 3 days before disclosure). - The latest release, 0.341.2, is not affected. ### [CVE-2025-22151](https://cve.now/CVE-2025-22151): Strawberry GraphQL has a type resolution vulnerability - Severity: Low 3.7 - Published: Jan 9, 2025 - Affected: from 0.182.0, fixed in 0.257.0. - Fixed in 0.257.0 (released Jan 9, 2025, the day of disclosure). - The latest release, 0.341.2, is not affected. ### [CVE-2024-47082](https://cve.now/CVE-2024-47082): Strawberry GraphQL Cross-Site Request Forgery (CSRF) vulnerability - Severity: Medium 4.6 - Published: Sep 25, 2024 - Affected: fixed in 0.243.0. - Fixed in 0.243.0 (released Sep 25, 2024, the day of disclosure). - The latest release, 0.341.2, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/pypi/strawberry-graphql Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.