ReDoS at wiki.cs.money graphQL endpoint (AND probably a kind of command injection)

Summary: The endpoint /graphql has a vulnerable query operation named "search", that can I send a Regex malformed parameter, in order to trick the original regular expression to a regex bomb expression.

query a { 
  search(q: "AAA", lang: "en") {
    _id
   weapon_id
    rarity
    collection{ _id name }
    collection_id 
 
 }
}