id: PYSEC-2026-2282
published: "2026-06-04T15:16:54.457Z"
modified: "2026-07-13T05:51:37.392488Z"
aliases:
- CVE-2026-45739
- GHSA-x97m-qp5c-w9xj
details: "Strawberry GraphQL is a library for creating GraphQL APIs. In versions 0.288.4 through 0.315.3, Strawberry's bundled GraphiQL template wrote values from the GraphiQL headers editor into the browser URL query string. If a user entered a sensitive header, such as `Authorization: Bearer <token>`, the value could become visible in browser history, copied links, and server/proxy/CDN access logs after a page reload or shared request. Version 0.315.4 patches the issue."
affected:
- package:
    name: strawberry-graphql
    ecosystem: PyPI
    purl: pkg:pypi/strawberry-graphql
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: 0.288.4
    - fixed: 0.315.4
  versions:
  - 0.288.4
  - 0.289.0
  - 0.289.1
  - 0.289.2
  - 0.289.3
  - 0.289.4
  - 0.289.5
  - 0.289.6
  - 0.289.7
  - 0.289.8
  - 0.290.0
  - 0.291.0
  - 0.291.1
  - 0.291.2
  - 0.291.2.dev1770456508
  - 0.291.2.dev1771437961
  - 0.291.3
  - 0.292.0
  - 0.293.0
  - 0.294.0
  - 0.295.0
  - 0.296.0
  - 0.296.1
  - 0.296.2
  - 0.297.0
  - 0.298.0
  - 0.298.1
  - 0.299.0
  - 0.300.0
  - 0.301.0
  - 0.302.0
  - 0.303.0
  - 0.303.1
  - 0.304.0
  - 0.305.0
  - 0.306.0
  - 0.307.0
  - 0.307.1
  - 0.308.0
  - 0.308.1
  - 0.308.2
  - 0.308.3
  - 0.309.0
  - 0.310.0
  - 0.310.1
  - 0.310.2
  - 0.311.0
  - 0.311.1
  - 0.311.2
  - 0.311.3
  - 0.312.0
  - 0.312.1
  - 0.312.2
  - 0.312.3
  - 0.312.4
  - 0.313.0
  - 0.314.0
  - 0.314.1
  - 0.314.2
  - 0.314.3
  - 0.315.0
  - 0.315.1
  - 0.315.2
  - 0.315.3
  ecosystem_specific: {}
references:
- type: ADVISORY
  url: https://github.com/strawberry-graphql/strawberry/releases/tag/0.315.4
- type: ADVISORY
  url: https://github.com/strawberry-graphql/strawberry/security/advisories/GHSA-x97m-qp5c-w9xj
- type: REPORT
  url: https://github.com/strawberry-graphql/strawberry/issues/4398
- type: FIX
  url: https://github.com/strawberry-graphql/strawberry/commit/9315ef80a621ae50ca0bc5c82f560ca4ee7e47a9
- type: FIX
  url: https://github.com/strawberry-graphql/strawberry/pull/2842
severity:
- type: CVSS_V3
  score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N