CVE-2025-55817

---

[Vulnerability Type]

Cross Site Scripting (XSS)

---

[Affected Component]

The Connection Settings of the Nitro GraphQL by Chillicream, contain 3 different input locations vulnerable to Cross Site Scripting (XSS). Vulnerable Parameters : SDL Schema Endpoint, Subscription Endpoint, SSE Subscription Endpoint

---

[Attack Type]

Remote

---

[Impact Information Disclosure]

true

---

[Attack Vectors]

3 input fields are vulnerable to XSS payloads :

---

[Has vendor confirmed]

true

---

[Discoverer]

Brian Lowe - KirkpatrickPrice - June 23, 2025

---

[Reference]

https://chillicream.com

---

[Vendor of Product]

Chillicream

---

[Affected Product Code Base]

Nitro GraphQL Middleware 28.0.13; Nitro GraphQL Cloud 28.0.13; Nitro GraphQL IDE 28.0.13

Chilicream has already worked to produce a patch...for remediation path to version 28.0.14