cruddl vulnerable to ArangoDB Query Language (AQL) injection through flexSearch

Description

If a vunerable version of cruddl is used to generate a schema that uses @flexSearchFulltext, users of that schema may be able to inject arbitrary AQL queries that will be forwarded to and executed by ArangoDB.

Schemas that do not use @flexSearchFulltext are not affected.

Recommendation

Update the cruddl package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 1.1.0, < 2.7.0

  >= 3.0.0, < 3.0.2**

• Patched version(s): **2.7.0

  3.0.2**

References

• GHSA-qm4w-4995-vg7f
• CVE-2022-36084
• CWE-74
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Mermaid does not properly sanitize architecture diagram iconText leading to XSS - CVE-2025-54880
• create-choo-app3 is vulnerable to Command Injection via the devInstall function - CVE-2022-25855
• Vue I18n Allows Prototype Pollution in `handleFlatJson` (GHSA-p2ph-7g93-hw3m) 5 - CVE-2025-27597
• Vue I18n Allows Prototype Pollution in `handleFlatJson` (GHSA-p2ph-7g93-hw3m) 4 - CVE-2025-27597

Tags:

npm

cruddl