CVE-2024-47082: medium-severity vulnerability in strawberry-graphql strawberry
Strawberry GraphQL Cross-Site Request Forgery (CSRF) vulnerability
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 4.6epss 0.2%
Strawberry GraphQL is a library for creating GraphQL APIs. Prior to version 0.243.0, multipart file upload support as defined in the GraphQL multipart request specification was enabled by default in all Strawberry HTTP view integrations. This made all Strawberry HTTP view integrations vulnerable to cross-site request forgery (CSRF) attacks if users did not explicitly enable CSRF preventing security mechanism for their servers. Additionally, the Django HTTP view integration, in particular, had an exemption for Django's built-in CSRF protection (i.e., the `CsrfViewMiddleware` middleware) by default. In affect, all Strawberry integrations were vulnerable to CSRF attacks by default. Version `v0.243.0` is the first `strawberry-graphql` including a patch.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L
Affected products
strawberry-graphql · strawberryRelated CVEs — strawberry-graphql strawberry
In the same product, most dangerous first.
CVE-2026-47707MEDIUMStrawberry GraphQL's Bypass of MaxAliasesLimiter via Fragment Spreads leading to GraphQL Alias AmplificationEPSS 0.5%CVE-2026-107728HIGHStrawberry GraphQL: Synchronous permission checks can treat an awaitable authorization result as truthyEPSS 0.4%CVE-2026-35523HIGHAuthentication bypass in strawberry-graphql via legacy graphql-ws WebSocket subprotocolEPSS 0.4%CVE-2026-107727LOWStrawberry legacy graphql-ws retains naturally completed subscription slotsEPSS 0.4%CVE-2025-22151LOWStrawberry GraphQL has a type resolution vulnerabilityEPSS 0.4%CVE-2026-47706MEDIUMStrawberry GraphQL has a Circular Fragment Reference DOSEPSS 0.3%