strawberry-graphql has 5 CVEs on record between 2025 and 2026. 1 was published in the last 90 days. The median CVSS is 5.3 (medium). None have a confirmed exploitation report.

CVEs per month

Last 12 months, by publish date

1125/111225/120126/010226/020326/030426/040526/050626/060726/070826/080926/091026/10

Exploited share: 0% vs 1% corpus
Median CVSS: 5.3
Publish → KEV: —
Last 90 days: 1 prev 3

Weakness classes

Products

strawberry-graphql 5

Follow strawberry-graphql:RSS feed Save a search →Embed badge ↗

Total CVEs

Critical

CISA KEV

Exploited

Worst active — by depth score

strawberry-graphql vulnerabilities

CVEs affecting strawberry-graphql, newest first. Open any entry for full detail, references, and exploit status.

5 CVEsRSS

CVE-2026-107728High· 7.5PoC

2w ago

Strawberry GraphQL is a library for creating GraphQL APIs

Strawberry GraphQL is a library for creating GraphQL APIs. From 0.217.0 until 0.326.1, PermissionExtension.resolve() on a synchronous field resolver evaluates the result of has_permission() for truthiness. When a custom permission declar…

▾ Midnightstrawberry-graphql · strawberry-graphqlEPSS 0.45%via NVD

CVE-2026-47706Medium· 5.3

4mo ago

Strawberry GraphQL has a Circular Fragment Reference DOS

▾ Sunlitstrawberry-graphql · strawberry-graphqlEPSS 0.30%via OSV

CVE-2026-47707Medium· 5.3

4mo ago

Strawberry GraphQL's Bypass of MaxAliasesLimiter via Fragment Spreads leading to GraphQL Alias Amplification

▾ Sunlitstrawberry-graphql · strawberry-graphqlEPSS 0.47%via OSV

CVE-2026-45739Low· 3.1

5mo ago

Strawberry GraphQL: Default GraphiQL may expose HTTP headers in URLs

▾ Sunlitstrawberry-graphql · strawberry-graphqlEPSS 0.22%via OSV

CVE-2025-22151Low· 3.7

1y ago

Strawberry GraphQL has type resolution vulnerability in node interface that allows potential data leakage through incorrect type resolution

▾ Sunlitstrawberry-graphql · strawberry-graphqlEPSS 0.39%via OSV