CVE-2026-63397 affects remorses genql prior to version 6.3.4. An authenticated attacker with control over the GraphQL schema passed to genql can inject arbitrary JavaScript or TypeScript code into the generated schema.ts file. This malicious code executes when the genql client is bundled and imported, resulting from improper encoding or escaping of output (CWE-116). The vulnerability has a CVSS 4.0 base score of 7.1, indicating high severity. No official patch or remediation level is currently documented.

Successful exploitation allows an authenticated attacker with schema control to execute arbitrary code within the genql client context. This can lead to code injection attacks, potentially compromising the integrity and security of applications using the vulnerable genql versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to schema modification capabilities to trusted users only and review generated schema.ts files for unauthorized code. Monitor vendor channels for updates regarding patches or official mitigations.