CVE-2020-4038: Prisma Graphql-Playground-Html

High severity, CVSS 7.4. EPSS: 7.2% chance of exploitation in the next 30 days.

GraphQL Playground (graphql-playground-html NPM package) before version 1.6.22 have a severe XSS Reflection attack vulnerability. All unsanitized user input passed into renderPlaygroundPage() method could trigger this vulnerability. This has been patched in graphql-playground-html version 1.6.22. Note that some of the associated dependent middleware packages are also affected including but not limited to graphql-playground-middleware-express before version 1.7.16, graphql-playground-middleware-koa before version 1.6.15, graphql-playground-middleware-lambda before version 1.7.17, and graphql-playground-middleware-hapi before 1.6.13.

Affected products

• Prisma Graphql-Playground-Html: before 1.6.22 (fixed in 1.6.22)
• Prisma Graphql-Playground-Middleware-Express: before 1.7.16 (fixed in 1.7.16)
• Prisma Graphql-Playground-Middleware-Hapi: before 1.6.13 (fixed in 1.6.13)
• Prisma Graphql-Playground-Middleware-Koa: before 1.6.15 (fixed in 1.6.15)
• Prisma Graphql-Playground-Middleware-Lambda: before 1.7.17 (fixed in 1.7.17)

Published 2020-06-08. Last modified 2026-06-17.