Detections
Analytics

SCA: security update for @graphql-tools/utils (GHSA-7mx3-vvmw-hjmv)

high Tenable Cloud Security Plugin ID 473029

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to 12.0.1,
 the GraphQL Tools utils package's mergeDeep function follows inherited properties while recursively
 merging source objects and does not exclude __proto__, constructor, or prototype keys. An unauthenticated
 GraphQL client can alias fields to those names so responses from two subgraphs collide during ordinary
 supergraph result merging, causing mergeDeep to traverse Object and Function prototypes and overwrite
 Function.prototype.call with a subgraph-supplied value. This breaks subsequent requests in the process
 until restart. This issue is fixed in version 12.0.1. (CVE-2026-104852)

Solution

Update the @graphql-tools/utils library and its related packages to version 12.0.1 or later.

See Also

https://github.com/advisories/GHSA-7mx3-vvmw-hjmv

Plugin Details

Severity: High

ID: 473029

Version: Revision 1.1

Type: Local

Family: SCA Checks

Published: 10/6/2026

Updated: 10/6/2026

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 58.41

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 5.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2026-104852

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: High

Base Score: 8.2

Threat Score: 4.6

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 10/5/2026

Vulnerability Publication Date: 10/5/2026

Reference Information

CVE: CVE-2026-104852