The GraphiQL page bundled with Spring for GraphQL loads JavaScript libraries from a public CDN, without Subresource Integrity checks. An attacked can inject malicious code in those scripts and execute aribtrary code on the browser loading the GraphiQL page.

More precisely, an application is vulnerable when all the following are true:

• the application has the GraphiQL endpoint enabled and exposed
• the CDN, or the network path to it, is compromised by an attacker

When all the conditions above are met, an attacker can serve malicious JavaScript in place of the expected CDN assets. The attacker can then have access to non-HttpOnly cookies and is able to issue authenticated same-origin requests, including GraphQL operations.

Exploiting this issue requires an attacker to first compromise a third party outside the application (the CDN itself or the network path to it).