CVE-2026-118666: GraphQL Tools: Shared legacy executor routes one subscription's results to a different caller

buildWSLegacyExecutor keeps one WebSocket in closure state and installs the message handler by assigning to the socket’s single websocket.onmessage property inside subscribe(). Every new subscription therefore overwrites the previous subscriber’s handler, and the handler’s case LEGACY_WS.DATA branch calls observer.next(data.payload) without ever comparing data.id to the operation id that this subscription created at line 103 and sent with START at line 123. When one executor instance is reused for overlapping subscriptions, the most recent caller receives payloads belonging to the earlier caller, and the earlier caller receives nothing.

In a consuming application, the tainted input is an ordinary, correctly-tagged DATA frame emitted by the legitimate downstream server for the victim’s operation. The attacker does not need to control or compromise that server; they only need to be able to start their own subscription through the same shared executor while the victim’s subscription is active — the natural shape of a gateway, stitched schema, or any service that builds a remote executor once and reuses it per request.

The surrounding code shows the inconsistency:

• packages/loaders/url/src/index.ts:262-295 (in-repo UrlLoader wrapper) → constructs a fresh legacy executor inside each request, so that caller avoids the shared state.
• buildWSLegacyExecutor’s returned executor, reused across callers → unsafe: shared onmessage overwritten at line 113, DATA dispatched without an id check at lines 145-147.
• packages/loaders/url/src/index.ts:172-182 → also a production caller of the legacy executor; safe only insofar as the wrapper above rebuilds the executor per request, not because of any check in the executor itself.