CVE-2024-23841

Summary

CVE-2024-23841 is a cross-site scripting (XSS) vulnerability affecting the Apollo Client support for Next.js App Router, specifically the @apollo/experimental-apollo-client-nextjs NPM package. An attacker can exploit this flaw by injecting malicious input through a crafted link or by manipulating a GraphQL server to return malicious data. To mitigate this risk, it's recommended to update to version 0.7.0 or later of the package.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.