Mozilla disclosed on HackerOne: Unauthenticated RCE in Taskcluster...
## Summary
The public GraphQL endpoint at `/graphql` allows an unauthenticated caller to execute arbitrary JavaScript inside the web-server's Node.js process. The query argument `filter` is a...
