CVE-2026-104852
HighAdvisory
Published 5 Oct 2026In the index since 6 Oct 2026
- Severity
- High
- worst across findings
- CVSS
- 8.2
- base score, highest
- EPSS
- —
- probability of exploitation
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 52
- of 18,026 indexed, latest versions
- Container images
- 47
- deployed by those charts
- Fix available
- 1 of 1
- affected package
GraphQL Tools has prototype pollution in well-established utility function `mergeDeep`
Carried by container images the latest versions of 52 of 18,026 indexed charts deploy, on 47 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| @graphql-tools/ | 7.2.4, 7.7.1, 8.0.2, 8.2.2+17 more | 12.0.1 | 47 |
- OSV records
- GHSA-7mx3-vvmw-hjmv
Charts affected
52 by stars
Container images carrying it
47 by charts deploying them
A fixed version is listed for 1 of the 1 affected package.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| ghcr.io/ | a4a3639899f7 | @graphql-tools/ | 12.0.1 | 3 |
| agoldis/ | afaa5a84051d | @graphql-tools/ | 12.0.1 | 2 |
| hoppscotch/ | f1da831950b7 | @graphql-tools/ | 12.0.1 | 2 |
| mesosphere/ | 3917e82333a9 | @graphql-tools/ | 12.0.1 | 2 |
| mojaloop/ | b45a2d6f0f2a | @graphql-tools/ | 12.0.1 | 2 |
| requarks/ | fffff288a52f | @graphql-tools/ | 12.0.1 | 2 |
| bicarus/ | dab88659ae3b | @graphql-tools/ | 12.0.1 | 1 |
| electerious/ | 5e7173fa321c | @graphql-tools/ | 12.0.1 | 1 |
| evershop/ | d0823576f91b | @graphql-tools/ | 12.0.1 | 1 |
| folioci/ | f0655a6a08fd | @graphql-tools/ | 12.0.1 | 1 |
| frinx/ | 17a139608024 | @graphql-tools/ | 12.0.1 | 1 |
| frinx/ | 5f1368ef47b8 | @graphql-tools/ | 12.0.1 | 1 |
| frinx/ | 6b1992c79e78 | @graphql-tools/ | 12.0.1 | 1 |
| frinx/ | 86c9ce1f5e31 | @graphql-tools/ | 12.0.1 | 1 |
| hoppscotch/ | 538fe6ded4b6 | @graphql-tools/ | 12.0.1 | 1 |
| hoppscotch/ | e7ba6061a286 | @graphql-tools/ | 12.0.1 | 1 |
| interlayhq/ | 423d567d47aa | @graphql-tools/ | 12.0.1 | 1 |
| interlayhq/ | 5b2c414307b9 | @graphql-tools/ | 12.0.1 | 1 |
| kubebb/ | 0fbb732379bc | @graphql-tools/ | 12.0.1 | 1 |
| kubebb/ | fd8ecbd73213 | @graphql-tools/ | 12.0.1 | 1 |
| nocodb/ | 6779a4ddedf2 | @graphql-tools/ | 12.0.1 | 1 |
| ohmyform/ | afe53f4acdb1 | @graphql-tools/ | 12.0.1 | 1 |
| requarks/ | 8b5865a7386c | @graphql-tools/ | 12.0.1 | 1 |
| requarks/ | af71a17dc27c | @graphql-tools/ | 12.0.1 | 1 |
| speckle/ | 49d10dcdfb91 | @graphql-tools/ | 12.0.1 | 1 |
| speckle/ | 4b6a0750d5aa | @graphql-tools/ | 12.0.1 | 1 |
| speckle/ | 52f8eabf5cea | @graphql-tools/ | 12.0.1 | 1 |
| speckle/ | 687f43ab16f3 | @graphql-tools/ | 12.0.1 | 1 |
| speckle/ | 75cdf256067b | @graphql-tools/ | 12.0.1 | 1 |
| speckle/ | 79f14a2bf931 | @graphql-tools/ | 12.0.1 | 1 |
| speckle/ | 89a5872375f9 | @graphql-tools/ | 12.0.1 | 1 |
| speckle/ | 8fd157733393 | @graphql-tools/ | 12.0.1 | 1 |
| speckle/ | bf6a501b2210 | @graphql-tools/ | 12.0.1 | 1 |
| speckle/ | e8413f57b327 | @graphql-tools/ | 12.0.1 | 1 |
| subsquid/ | 0889a857f192 | @graphql-tools/ | 12.0.1 | 1 |
| treskon/ | e7970783bc8d | @graphql-tools/ | 12.0.1 | 1 |
| twentycrm/ | 47bcefe4e497 | @graphql-tools/ | 12.0.1 | 1 |
| twentycrm/ | b2b662b1bef1 | @graphql-tools/ | 12.0.1 | 1 |
| twentycrm/ | e7d9948bf284 | @graphql-tools/ | 12.0.1 | 1 |
| veecode/ | 881f936ff4a3 | @graphql-tools/ | 12.0.1 | 1 |
| ghcr.io/ | e2a48bb6ab55 | @graphql-tools/ | 12.0.1 | 1 |
| ghcr.io/ | 58d377933678 | @graphql-tools/ | 12.0.1 | 1 |
| ghcr.io/ | b649f5ce2384 | @graphql-tools/ | 12.0.1 | 1 |
| ghcr.io/ | 49800ff775f3 | @graphql-tools/ | 12.0.1 | 1 |
| public.ecr.aws/ | a2057fabc948 | @graphql-tools/ | 12.0.1 | 1 |
| quay.io/ | ce6938ff6709 | @graphql-tools/ | 12.0.1 | 1 |
| quay.io/ | 4f8c0f8a8ee0 | @graphql-tools/ | 12.0.1 | 1 |