Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:composer/api-platform/graphql@3.4.17
purl pkg:composer/api-platform/graphql@3.4.17
Vulnerabilities affecting this package (0)
Vulnerability Summary Fixed by
This package is not known to be affected by vulnerabilities.
Vulnerabilities fixed by this package (2)
Vulnerability Summary Aliases
VCID-ezka-28sk-rbaz API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. Using the Relay special node type you can bypass the configured security on an operation. This vulnerability is fixed in 4.0.22 and 3.4.17. CVE-2025-31481
GHSA-cg3c-245w-728m
VCID-h6xs-dtvv-mffa API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. Prior to 4.0.22 and 3.4.17, a GraphQL grant on a property might be cached with different objects. The ApiPlatform\GraphQl\Serializer\ItemNormalizer::isCacheKeySafe() method is meant to prevent the caching but the parent::normalize method that is called afterwards still creates the cache key and causes the issue. This vulnerability is fixed in 4.0.22 and 3.4.17. CVE-2025-31485
GHSA-428q-q3vv-3fq3

Date Actor Action Vulnerability Source VulnerableCode Version
2026-06-15T01:55:12.081148+00:00 GHSA Importer Fixing VCID-h6xs-dtvv-mffa https://github.com/advisories/GHSA-428q-q3vv-3fq3 38.6.0
2026-06-15T01:55:11.884855+00:00 GHSA Importer Fixing VCID-ezka-28sk-rbaz https://github.com/advisories/GHSA-cg3c-245w-728m 38.6.0
2026-06-13T15:13:35.783138+00:00 GitLab Importer Fixing VCID-h6xs-dtvv-mffa https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/api-platform/graphql/CVE-2025-31485.yml 38.6.0
2026-06-13T15:13:35.456484+00:00 GitLab Importer Fixing VCID-ezka-28sk-rbaz https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/api-platform/graphql/CVE-2025-31481.yml 38.6.0
2026-06-12T07:52:40.656651+00:00 GithubOSV Importer Fixing VCID-ezka-28sk-rbaz https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/04/GHSA-cg3c-245w-728m/GHSA-cg3c-245w-728m.json 38.6.0
2026-06-12T07:52:37.739097+00:00 GithubOSV Importer Fixing VCID-h6xs-dtvv-mffa https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/04/GHSA-428q-q3vv-3fq3/GHSA-428q-q3vv-3fq3.json 38.6.0