An authenticated attacker who can supply a GraphQL schema to the Genql CLI can inject arbitrary JavaScript or TypeScript. The injected code is written into the generated schema.ts file and executed when the client is bundled and imported, giving the attacker execution rights in the context of the built application. The flaw is a classic example of improper input sanitization, identified as CWE‑116. The resulting impact is the ability to run arbitrary code, potentially compromising confidentiality, integrity, and availability of systems that use the generated client.

The issue affects the Genql tool from remorses, specifically all releases before version 6.3.4. Any deployment that uses the genql CLI to generate schema files and subsequently bundles those files into a JavaScript or TypeScript application is at risk. The vulnerability is limited to environments where the attacker can influence the GraphQL schema input, such as developer or build systems with authenticated access.

The CVE awards a CVSS score of 7.1, indicating high risk. The EPSS score is less than 1%, suggesting a low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack requires the attacker to be authenticated within the environment that generates the schema, supply a crafted schema, then build and deploy the resulting client. Once the client is bundled and imported, the injected JavaScript or TypeScript runs, enabling the attacker to execute arbitrary code.