CVE-2026-41327: Dgraph Cve 2026 41327 Dql Cond Injectioncve-2026-41327-dgraph-cve-2026-41327-dql-cond-injection
Potential DQL injection (CVE-2026-41327): a user-controlled upsert `cond` value is being transformed by `strings.Replace($X, "@if", "@filter", 1)` and concatenated into a DQL query without prior structural validation. The `strings.Replace` call is a cosmetic syntax rewrite, not a security boundary. An attacker can craft a `cond` that closes the `@filter(...)
