{
  "aliases": [
    "GHSA-w42g-7vfc-xf37",
    "GMS-2020-65"
  ],
  "summary": "Introspection in schema validation in Apollo Server\nIf `subscriptions: false` is passed to the `ApolloServer` constructor options, there is no impact. If implementors were not expecting validation rules to be enforced on the WebSocket subscriptions transport **and** are unconcerned about introspection being enabled on the WebSocket subscriptions transport (or were not expecting that), then this advisory is not applicable. If `introspection: true` is passed to the `ApolloServer` constructor options, the impact is limited to user-provided validation rules (i.e., using `validationRules`) since\u00a0there would be no expectation that introspection was disabled.",
  "affected_packages": [
    {
      "package": {
        "type": "npm",
        "namespace": null,
        "name": "apollo-server-express",
        "version": null,
        "qualifiers": null,
        "subpath": null
      },
      "affected_version_range": "vers:npm/<2.14.2",
      "fixed_version": "2.14.2"
    }
  ],
  "references": [
    {
      "reference_id": "GHSA-w42g-7vfc-xf37",
      "url": "https://github.com/apollographql/apollo-server/security/advisories/GHSA-w42g-7vfc-xf37",
      "severities": []
    },
    {
      "reference_id": "",
      "url": "https://github.com/apollographql/apollo-server/commit/e2e816316f5c28a03de2ee1589edb2b10c358114",
      "severities": []
    },
    {
      "reference_id": "GHSA-w42g-7vfc-xf37",
      "url": "https://github.com/advisories/GHSA-w42g-7vfc-xf37",
      "severities": []
    }
  ],
  "date_published": "2020-06-05T00:00:00+00:00"
}