{"metadata": {"vulnerability": "CVE-2026-114604", "count": 20, "kinds": {"milestone": 5, "sighting": 3, "kev": 0, "other": 12}, "linked_omitted": 0}, "data": [{"timestamp": "2026-09-30T21:41:27Z", "date_only": false, "value": "2026-09-30T21:41:27.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/ardatan/graphql-tools/security/advisories/GHSA-c4qx-w738-7hr3", "record": "CVE-2026-114604", "field": "creation_timestamp", "uuid": "6b54557a-d6da-4df7-94dc-faa3ade9f2f4", "url": "https://github.com/ardatan/graphql-tools/security/advisories/GHSA-c4qx-w738-7hr3", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-10-21T20:34:25.599Z", "date_only": false, "value": "2026-10-21T20:34:25.599Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-114604", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-22T16:28:31Z", "date_only": false, "value": "2026-10-22T16:28:31Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-C4QX-W738-7HR3", "record": "GHSA-C4QX-W738-7HR3", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-22T16:28:31Z", "date_only": false, "value": "2026-10-22T16:28:31Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-C4QX-W738-7HR3", "record": "GHSA-C4QX-W738-7HR3", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-05T00:00:00Z", "date_only": false, "value": "2026-11-05T00:00:00Z", "kind": "other", "label": "Advisory revision", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:12429-1", "record": "OPENSUSE-SU-2026:12429-1", "field": "document.tracking.revision_history.0.date", "linked_record": true}, {"timestamp": "2026-11-05T00:00:00Z", "date_only": false, "value": "2026-11-05T00:00:00Z", "kind": "other", "label": "Document generated", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:12429-1", "record": "OPENSUSE-SU-2026:12429-1", "field": "document.tracking.generator.date", "linked_record": true}, {"timestamp": "2026-11-05T00:00:00Z", "date_only": false, "value": "2026-11-05T00:00:00Z", "kind": "other", "label": "Impact", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:12429-1", "record": "OPENSUSE-SU-2026:12429-1", "field": "vulnerabilities.0.threats.0.date", "linked_record": true}, {"timestamp": "2026-11-05T00:00:00Z", "date_only": false, "value": "2026-11-05T00:00:00Z", "kind": "milestone", "label": "Published", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:12429-1", "record": "OPENSUSE-SU-2026:12429-1", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-05T20:37:39.814Z", "date_only": false, "value": "2026-11-05T20:37:39.814Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-114604", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-05T20:37:39.814Z", "date_only": false, "value": "2026-11-05T20:37:39.814Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-114604", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-05T21:00:14.833Z", "date_only": false, "value": "2026-11-05T21:00:14.833639Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117565843986968396", "record": "CVE-2026-114604", "field": "creation_timestamp", "uuid": "164c102d-00e4-4d6e-8f18-e5613191e20d", "content": "CVE-2026-114604 GraphQL Tools: Prototype pollution in mergeIncrementalResult via non-primitive path segments GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. From 10.10.1 until 12.0.2, the @graphql-tools/utils mergeIncrementalResult helper passes incrementalResult.path segments to setObjectKeyPath without runtime primitive-type validation. A non-primitive segment can bypass strict comparisons against __proto__, constructor, and prototype, then be coerced during property access so a malicious or compromised upstream incremental GraphQL response writes attacker-controlled properties to Object.prototype in the consuming Node.js process. The affected implementation is packages/utils/src/mergeIncrementalResult.ts and is reachable when consumers merge untrusted @defer or @stream transport results. This issue is fixed in version 12.0.2.\nhttps://www.cve.org/CVERecord?id=CVE-2026-114604https://github.com/ardatan/graphql-tools/security/advisories/GHSA-c4qx-w738-7hr3https://github.com/ardatan/graphql-tools/pull/8467https://github.com/ardatan/graphql-tools/commit/19f5b3373fd7ace0688d19950fc529ce8347952ahttps://github.com/ardatan/graphql-tools/commit/20d36a5c6eb8fd5524420988e01a48618c450d70https://github.com/ardatan/graphql-tools/releases/tag/@graphql-tools/utils@12.0.2#ardatan #graphql-tools#CVE_2026_114604#bot", "url": "https://infosec.exchange/users/cve/statuses/117565843986968396"}, {"timestamp": "2026-11-05T21:18:37.057Z", "date_only": false, "value": "2026-11-05T21:18:37.057", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-114604", "record": "FKIE_CVE-2026-114604", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-06T11:20:05.428Z", "date_only": false, "value": "2026-11-06T11:20:05.428018Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mznb7nxqwv2v", "record": "CVE-2026-114604", "field": "creation_timestamp", "uuid": "26c2915b-6756-48c9-919b-e8c751c54e88", "content": "CVE-2026-114604 - @graphql-tools/utils\nVersions of GraphQL Tools utilities from 10.10.1 through 12.0.1 can accept specially crafted GraphQL responses and unintentionally change the global Object prototype\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#graphqltools #npm #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mznb7nxqwv2v"}, {"timestamp": "2026-11-06T11:27:15Z", "date_only": false, "value": "2026-11-06T11:27:15Z", "kind": "other", "label": "Advisory revision", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:12429-1", "record": "OPENSUSE-SU-2026:12429-1", "field": "document.tracking.revision_history.1.date", "linked_record": true}, {"timestamp": "2026-11-06T11:27:15Z", "date_only": false, "value": "2026-11-06T11:27:15Z", "kind": "other", "label": "Updated", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:12429-1", "record": "OPENSUSE-SU-2026:12429-1", "field": "document.tracking.current_release_date", "linked_record": true}, {"timestamp": "2026-11-09T18:37:03.413Z", "date_only": false, "value": "2026-11-09T18:37:03.413717Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-114604", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-11-09T18:37:03.413Z", "date_only": false, "value": "2026-11-09T18:37:03.413717Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-114604", "record": "FKIE_CVE-2026-114604", "field": "metrics.ssvcV203.0.ssvcData.timestamp", "linked_record": true}, {"timestamp": "2026-11-09T18:37:52.147Z", "date_only": false, "value": "2026-11-09T18:37:52.147Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-114604", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-11-09T18:37:52.147Z", "date_only": false, "value": "2026-11-09T18:37:52.147Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-114604", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-09T19:16:41.843Z", "date_only": false, "value": "2026-11-09T19:16:41.843", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-114604", "record": "FKIE_CVE-2026-114604", "field": "lastModified", "linked_record": true}], "metrics": {"as_of": "2026-11-11T08:52:55.862Z", "anchors": {"origin": {"timestamp": "2026-10-22T16:28:31Z", "date_only": false, "value": "2026-10-22T16:28:31Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-C4QX-W738-7HR3", "record": "GHSA-C4QX-W738-7HR3", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-10-22T16:28:31Z", "date_only": false, "value": "2026-10-22T16:28:31Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-C4QX-W738-7HR3", "record": "GHSA-C4QX-W738-7HR3", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "exploit_publication": {"timestamp": "2026-09-30T21:41:27Z", "date_only": false, "value": "2026-09-30T21:41:27.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/ardatan/graphql-tools/security/advisories/GHSA-c4qx-w738-7hr3", "record": "CVE-2026-114604", "field": "creation_timestamp", "uuid": "6b54557a-d6da-4df7-94dc-faa3ade9f2f4", "url": "https://github.com/ardatan/graphql-tools/security/advisories/GHSA-c4qx-w738-7hr3", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": true, "seconds": -1882024.0, "hours": -522.7844444444445, "days": -21.782685185185183, "min_seconds": -1882024.0, "max_seconds": -1882024.0, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": true, "start": {"timestamp": "2026-10-22T16:28:31Z", "date_only": false, "value": "2026-10-22T16:28:31Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-C4QX-W738-7HR3", "record": "GHSA-C4QX-W738-7HR3", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "end": {"timestamp": "2026-09-30T21:41:27Z", "date_only": false, "value": "2026-09-30T21:41:27.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/ardatan/graphql-tools/security/advisories/GHSA-c4qx-w738-7hr3", "record": "CVE-2026-114604", "field": "creation_timestamp", "uuid": "6b54557a-d6da-4df7-94dc-faa3ade9f2f4", "url": "https://github.com/ardatan/graphql-tools/security/advisories/GHSA-c4qx-w738-7hr3", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 1700664.862229, "hours": 472.4069061747222, "days": 19.68362109061343, "min_seconds": 1700664.862229, "max_seconds": 1700664.862229, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-22T16:28:31Z", "date_only": false, "value": "2026-10-22T16:28:31Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-C4QX-W738-7HR3", "record": "GHSA-C4QX-W738-7HR3", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "end": {"timestamp": "2026-11-11T08:52:55.862Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": true, "seconds": 3582688.862229, "hours": 995.1913506191667, "days": 41.46630627579861, "min_seconds": 3582688.862229, "max_seconds": 3582688.862229, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-09-30T21:41:27Z", "date_only": false, "value": "2026-09-30T21:41:27.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/ardatan/graphql-tools/security/advisories/GHSA-c4qx-w738-7hr3", "record": "CVE-2026-114604", "field": "creation_timestamp", "uuid": "6b54557a-d6da-4df7-94dc-faa3ade9f2f4", "url": "https://github.com/ardatan/graphql-tools/security/advisories/GHSA-c4qx-w738-7hr3", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "end": {"timestamp": "2026-11-11T08:52:55.862Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}}}