Dgraph, an open source distributed GraphQL database, is affected by a DQL injection vulnerability (CWE-943) in the checkUserPassword query prior to version 25.3.4. The vulnerability arises from unsafe use of fmt.Sprintf to insert user-supplied password values directly into a DQL checkpwd() query string without escaping special characters. An attacker can exploit this by injecting a password containing a double-quote character to break out of the intended string literal and append arbitrary DQL query blocks, potentially leading to unauthorized data exposure. The vulnerability has a CVSS 3.1 base score of 7.5 (high severity) with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts confidentiality but not integrity or availability. The issue is resolved in Dgraph version 25.3.4.

Successful exploitation allows an unauthenticated attacker to inject arbitrary DQL commands via the password parameter in the checkUserPassword query, potentially exposing sensitive data. The vulnerability impacts confidentiality but does not affect integrity or availability. There are no known exploits in the wild at this time.

Upgrade Dgraph to version 25.3.4 or later, where this vulnerability is patched. No other official remediation or temporary fixes are documented. Patch status is confirmed by the versioning information indicating the fix in 25.3.4.