graphql-yoga vulnerabilities