Vulnerability Lookup

🛡️ CVE-2025-27407

🔴 CVSS 9.5 — Critical ✅ No Known Exploit CWE-94 NVD

9.5

CVSS Score

0 Low4 Medium7 High9 Critical10

Description

graphql-ruby is a Ruby implementation of GraphQL. Starting in version 1.11.5 and prior to versions 1.11.8, 1.12.25, 1.13.24, 2.0.32, 2.1.14, 2.2.17, and 2.3.21, loading a malicious schema definition in `GraphQL::Schema.from_introspection` (or `GraphQL::Schema::Loader.load`) can result in remote code execution. Any system which loads a schema by JSON from an untrusted source is vulnerable, including those that use GraphQL::Client to load external schemas via GraphQL introspection. Versions 1.11.8, 1.12.25, 1.13.24, 2.0.32, 2.1.14, 2.2.17, and 2.3.21 contain a patch for the issue.

Details

Severity CRITICAL

CVSS Score 9.5

CVSS Vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

CWE CWE-94

Public Exploit ✅ No

Source NVD

Published 2025-03-12

Updated 2026-06-15

Modified 2025-11-03

Fix URL N/A

Affected Packages

Software	From version	Fixed in
graphql	1.11.5	1.11.11
unknown	—	—

References

WEB https://github.com/rmosolgo/graphql-ruby/security/advisories/GHSA-q92j-grw3-h492

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2025-27407

WEB https://github.com/rmosolgo/graphql-ruby/commit/28233b16c0eb9d0fb7808f4980e061dc7507c4cd

WEB https://github.com/rmosolgo/graphql-ruby/commit/2d2f4ed1f79472f8eed29c864b039649e1de238f

WEB https://github.com/rmosolgo/graphql-ruby/commit/5c5a7b9a9bdce143be048074aea50edb7bb747be

WEB https://github.com/rmosolgo/graphql-ruby/commit/6eca16b9fa553aa957099a30dbde64ddcdac52ca

WEB https://github.com/rmosolgo/graphql-ruby/commit/d0963289e0dab4ea893bbecf12bb7d89294957bb

WEB https://github.com/rmosolgo/graphql-ruby/commit/d1117ae0361d9ed67e0795b07f5c3e98e62f3c7c

WEB https://github.com/rmosolgo/graphql-ruby/commit/e3b33ace05391da2871c75ab4d3b66e29133b367

WEB https://github.com/rmosolgo/graphql-ruby/commit/e58676c70aa695e3052ba1fbc787efee4ba7d67e

WEB https://about.gitlab.com/releases/2025/03/12/patch-release-gitlab-17-9-2-released

WEB https://github.com/github-community-projects/graphql-client

PACKAGE https://github.com/rmosolgo/graphql-ruby

WEB https://github.com/rubysec/ruby-advisory-db/blob/master/gems/graphql/CVE-2025-27407.yml

WEB https://lists.debian.org/debian-lts-announce/2025/08/msg00002.html

🔗 NVD 🔗 Mitre

Similar Threats

Exploit Protection

Help block exploit attempts

BotEraser is designed to detect and help reduce malicious bot traffic that may target known vulnerabilities on your site.

Try BotEraser Free →

No credit card required · Results in minutes

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the vulnerabilities listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.

Help block exploit attempts

Company

Resources

Services

Trusted

Subscribe