CVE-2022-36084

cruddl is software for creating a GraphQL API for a database, using the GraphQL SDL to model a schema. If cruddl starting with version 1.1.0 and prior to versions 2.7.0 and 3.0.2 is used to generate a schema that uses `@flexSearchFulltext`, users of that schema may be able to inject arbitrary AQL queries that will be forwarded to and executed by ArangoDB. Schemas that do not use `@flexSearchFulltext` are not affected. The attacker needs to have `READ` permission to at least one root entity type that has `@flexSearchFulltext` enabled. The issue has been fixed in version 3.0.2 and in version 2.7.0 of cruddl. As a workaround, users can temporarily remove `@flexSearchFulltext` from their schemas.

• CWE-74
• CWE-943

• https://github.com/AEB-labs/cruddl/commit/13b9233733ed6fc822718a07bc90a80cd3492698Patch, Third Party Advisory
• https://github.com/AEB-labs/cruddl/pull/253Patch, Third Party Advisory
• https://github.com/AEB-labs/cruddl/security/advisories/GHSA-qm4w-4995-vg7fVendor Advisory
• https://github.com/AEB-labs/cruddl/commit/13b9233733ed6fc822718a07bc90a80cd3492698Patch, Third Party Advisory
• https://github.com/AEB-labs/cruddl/pull/253Patch, Third Party Advisory
• https://github.com/AEB-labs/cruddl/security/advisories/GHSA-qm4w-4995-vg7fVendor Advisory

Published

Sep 8, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-36079Parse Server is an open source backend that can be deployed …7.5
• CVE-2022-3608Cross-site Scripting (XSS) - Stored in GitHub repository tho…8.4
• CVE-2022-36080Wikmd is a file based wiki that uses markdown. Prior to vers…6.1
• CVE-2022-36081Wikmd is a file based wiki that uses markdown. Prior to vers…7.5
• CVE-2022-36082mangadex-downloader is a command-line tool to download manga…5.3
• CVE-2022-36083JOSE is "JSON Web Almost Everything" - JWA, JWS, JWE, JWT, J…5.3
• CVE-2022-36085Open Policy Agent (OPA) is an open source, general-purpose p…9.8
• CVE-2022-36086linked_list_allocator is an allocator usable for no_std syst…9.8
• CVE-2022-36087OAuthLib is an implementation of the OAuth request-signing l…6.5
• CVE-2022-36088GoCD is a continuous delivery server. Windows installations …5.5
• CVE-2022-36089KubeVela is an application delivery platform Users using Kub…9.8
• CVE-2022-3609The GetYourGuide Ticketing WordPress plugin before 1.0.4 doe…4.8