{"schema_version":"1.3.1","id":"GO-2026-5837","modified":"2026-07-23T17:20:08Z","published":"2026-07-07T15:26:32Z","aliases":["CVE-2026-44840","GHSA-q2m9-6jp9-c6mc"],"summary":"DQL injection via checkUserPassword GraphQL query in github.com/dgraph-io/dgraph","details":"The checkUserPassword GraphQL query in Dgraph is vulnerable to Dgraph Query Language (DQL) injection. User-supplied password values are interpolated directly into a DQL checkpwd query without escaping or parameterization. An attacker can inject a password containing a double-quote character to break out of the DQL string literal and append arbitrary DQL query blocks.","affected":[{"package":{"name":"github.com/dgraph-io/dgraph","ecosystem":"Go"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"ecosystem_specific":{"imports":[{"path":"github.com/dgraph-io/dgraph"}]}},{"package":{"name":"github.com/hypermodeinc/dgraph/v24","ecosystem":"Go"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"ecosystem_specific":{"imports":[{"path":"github.com/hypermodeinc/dgraph/v24"}]}},{"package":{"name":"github.com/dgraph-io/dgraph/v25","ecosystem":"Go"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"25.3.4"}]}],"ecosystem_specific":{"imports":[{"path":"github.com/dgraph-io/dgraph/v25"}]}}],"references":[{"type":"ADVISORY","url":"https://github.com/dgraph-io/dgraph/security/advisories/GHSA-q2m9-6jp9-c6mc"},{"type":"FIX","url":"https://github.com/dgraph-io/dgraph/commit/cee702c93f141eeb0c96a81f70830ec9e459efac"},{"type":"WEB","url":"https://github.com/dgraph-io/dgraph/releases/tag/v25.3.4"}],"database_specific":{"url":"https://pkg.go.dev/vuln/GO-2026-5837","review_status":"REVIEWED"}}