Dgraph, an open source distributed GraphQL database, has a DQL injection vulnerability (CWE-943) in the checkUserPassword query prior to version 25.3.4. The vulnerability arises because password values are inserted into a DQL checkpwd() query using fmt.Sprintf without escaping or parameterization, enabling attackers to break out of the intended string context and append arbitrary DQL commands. This can lead to unauthorized data exposure due to improper neutralization of special elements in query logic. The vulnerability has a CVSS 3.1 base score of 7.5 (high severity) with network attack vector, low attack complexity, no privileges or user interaction required, and impacts confidentiality but not integrity or availability. The issue is resolved in version 25.3.4.

An attacker can exploit this vulnerability to perform DQL injection by crafting a password input containing special characters to manipulate the query logic. This can result in unauthorized disclosure of sensitive data from the database. The vulnerability affects confidentiality but does not impact integrity or availability. No known exploits are reported in the wild at this time.

Upgrade Dgraph to version 25.3.4 or later, where this vulnerability is patched. Since the vendor advisory confirms the fix in 25.3.4, applying this official update is the recommended remediation. Patch status is confirmed by the vendor advisory stating the issue is fixed in 25.3.4.