GraphQL Injection vulnerability in the Orchestrator Plugin of RH Developer Hub (Backstage). The flaw is caused by improper neutralization of special characters within user-supplied input fields that are directly embedded into backend GraphQL queries. By submitting specially crafted JSON payloads containing malicious GraphQL fragments (e.g., manipulated orderBy or filter values), an authenticated attacker can break query structure and trigger unhandled exceptions. This results in the entire Backstage application crashing and automatically restarting, leading to a platform-wide Denial of Service. The vulnerability can be exploited remotely by any authenticated user without additional privileges or user interaction, causing a high impact on service availability.