Remote code execution when loading a crafted GraphQL schema
Priority MEDIUM 47CWE-94Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-94.
Summary
graphql-ruby is a Ruby implementation of GraphQL. Starting in version 1.11.5 and prior to versions 1.11.8, 1.12.25, 1.13.24, 2.0.32, 2.1.14, 2.2.17, and 2.3.21, loading a malicious schema definition in `GraphQL::Schema.from_introspection` (or `GraphQL::Schema::Loader.load`) can result in remote code execution. Any system which loads a schema by JSON from an untrusted source is vulnerable, including those that use GraphQL::Client to load external schemas via GraphQL introspection. Versions 1.11.8, 1.12.25, 1.13.24, 2.0.32, 2.1.14, 2.2.17, and 2.3.21 contain a patch for the issue.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.03102 87th percentileScored 2026-11-07
Fix Fixed graphql-ruby (rmosolgo): 1.11.8, 1.12.25, 1.13.24 +4graphql (RubyGems): 2.4.13, 2.3.21, 2.2.17 +5Red Hat: 4 advisories
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| rmosolgo | graphql-ruby | 1.11.5 to before 1.11.8; 1.12.0 to before 1.12.25; 1.13.0 to before 1.13.24; 2.0.0 to before 2.0.32; 2.1.0 to before 2.1.14; 2.2.0 to before 2.2.17; 2.3.0 to before 2.3.21 | 1.11.8, 1.12.25, 1.13.24, 2.0.32, 2.1.14, 2.2.17, 2.3.21 | Patch available | CNA |
| — | graphql (RubyGems) | 2.4.0 to before 2.4.13 | 2.4.13 | Patch available | GHSA-q92j-grw3-h492 |
| — | graphql (RubyGems) | 2.3.0 to before 2.3.21 | 2.3.21 | Patch available | GHSA-q92j-grw3-h492 |
| — | graphql (RubyGems) | 2.2.0 to before 2.2.17 | 2.2.17 | Patch available | GHSA-q92j-grw3-h492 |
| — | graphql (RubyGems) | 2.1.0 to before 2.1.15 | 2.1.15 | Patch available | GHSA-q92j-grw3-h492 |
| — | graphql (RubyGems) | 2.0.0 to before 2.0.32 | 2.0.32 | Patch available | GHSA-q92j-grw3-h492 |
| — | graphql (RubyGems) | 1.13.0 to before 1.13.24 | 1.13.24 | Patch available | GHSA-q92j-grw3-h492 |
| — | graphql (RubyGems) | 1.12.0 to before 1.12.25 | 1.12.25 | Patch available | GHSA-q92j-grw3-h492 |
| — | graphql (RubyGems) | 1.11.5 to before 1.11.11 | 1.11.11 | Patch available | GHSA-q92j-grw3-h492 |
- graphql-ruby Vendorrmosolgo Affected 1.11.5 to before 1.11.8; 1.12.0 to before 1.12.25; 1.13.0 to before 1.13.24; 2.0.0 to before 2.0.32; 2.1.0 to before 2.1.14; 2.2.0 to before 2.2.17; 2.3.0 to before 2.3.21 Fixed in 1.11.8, 1.12.25, 1.13.24, 2.0.32, 2.1.14, 2.2.17, 2.3.21 Patch available CNA
- graphql (RubyGems) Vendor— Affected 2.4.0 to before 2.4.13 Fixed in 2.4.13 Patch available GHSA-q92j-grw3-h492
- graphql (RubyGems) Vendor— Affected 2.3.0 to before 2.3.21 Fixed in 2.3.21 Patch available GHSA-q92j-grw3-h492
- graphql (RubyGems) Vendor— Affected 2.2.0 to before 2.2.17 Fixed in 2.2.17 Patch available GHSA-q92j-grw3-h492
- graphql (RubyGems) Vendor— Affected 2.1.0 to before 2.1.15 Fixed in 2.1.15 Patch available GHSA-q92j-grw3-h492
- graphql (RubyGems) Vendor— Affected 2.0.0 to before 2.0.32 Fixed in 2.0.32 Patch available GHSA-q92j-grw3-h492
- graphql (RubyGems) Vendor— Affected 1.13.0 to before 1.13.24 Fixed in 1.13.24 Patch available GHSA-q92j-grw3-h492
- graphql (RubyGems) Vendor— Affected 1.12.0 to before 1.12.25 Fixed in 1.12.25 Patch available GHSA-q92j-grw3-h492
- graphql (RubyGems) Vendor— Affected 1.11.5 to before 1.11.11 Fixed in 1.11.11 Patch available GHSA-q92j-grw3-h492
Remediation
- Fix · CNA graphql-ruby (rmosolgo) Fixed in 1.11.8, 1.12.25, 1.13.24, 2.0.32, 2.1.14, 2.2.17, 2.3.21
- Fix · GHSA-q92j-grw3-h492 graphql (RubyGems) Fixed in 2.4.13 Advisory →
- Fix · GHSA-q92j-grw3-h492 graphql (RubyGems) Fixed in 2.3.21 Advisory →
- Fix · GHSA-q92j-grw3-h492 graphql (RubyGems) Fixed in 2.2.17 Advisory →
- Fix · GHSA-q92j-grw3-h492 graphql (RubyGems) Fixed in 2.1.15 Advisory →
- Fix · GHSA-q92j-grw3-h492 graphql (RubyGems) Fixed in 2.0.32 Advisory →
- Fix · GHSA-q92j-grw3-h492 graphql (RubyGems) Fixed in 1.13.24 Advisory →
- Fix · GHSA-q92j-grw3-h492 graphql (RubyGems) Fixed in 1.12.25 Advisory →
- Fix · GHSA-q92j-grw3-h492 graphql (RubyGems) Fixed in 1.11.11 Advisory →
Red Hat 4 advisories
- RHSA-2025:4576 Released 2025-05-06 · Red Hat rating ImportantSatellite 6.17.0 release
- Red Hat Satellite 6.17 for RHEL 9 python-django-4.2.19-1.el9pc, python-jinja2-3.1.5-1.el9pc, python3.11-django-4.2.19-1.el9pc +3
- RHSA-2025:3490 Released 2025-04-01 · Red Hat rating ImportantSatellite 6.16.4 Async Update
- Red Hat Satellite 6.16 for RHEL 8 rubygem-graphql-1.13.24-1.el8sat, rubygem-rack-2.2.13-1.el8sat
- Red Hat Satellite 6.16 for RHEL 9 rubygem-graphql-1.13.24-1.el9sat, rubygem-rack-2.2.13-1.el9sat
- RHSA-2025:3492 Released 2025-04-01 · Red Hat rating ImportantSatellite 6.14.4.5 Async Update
- Red Hat Satellite 6.14 for RHEL 8 rubygem-graphql-1.13.24-1.el8sat, rubygem-rack-2.2.13-1.el8sat
Show 1 more Red Hat advisories
- RHSA-2025:3491 Released 2025-04-01 · Red Hat rating ImportantSatellite 6.15.5.2 Async Update
- Red Hat Satellite 6.15 for RHEL 8 python-jinja2-3.1.5-1.el8pc, python3.11-jinja2-3.1.5-1.el8pc, rubygem-graphql-1.13.24-1.el8sat +1
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Satellite 6.14 for RHEL 8 | Fixed | RHSA-2025:3492 |
| Red Hat Satellite 6.15 for RHEL 8 | Fixed | RHSA-2025:3491 |
| Red Hat Satellite 6.16 for RHEL 8 | Fixed | RHSA-2025:3490 |
| Red Hat Satellite 6.16 for RHEL 9 | Fixed | RHSA-2025:3490 |
| Red Hat Satellite 6.17 for RHEL 9 | Fixed | RHSA-2025:4576 |
Not affected: 5 products
- Red Hat Satellite 6.14 for RHEL 8
- Red Hat Satellite 6.15 for RHEL 8
- Red Hat Satellite 6.16 for RHEL 8
- Red Hat Satellite 6.16 for RHEL 9
- Red Hat Satellite 6.17 for RHEL 9
Timeline
- 2026-10-02 Threatist record created from CVE-2025-27407
- 2026-10-03 Alias added: GHSA-q92j-grw3-h492
References
Other 14
- https://github.com/rmosolgo/graphql-ruby/security/advisories/GHSA-q92j-grw3-h492
- https://github.com/rmosolgo/graphql-ruby/commit/28233b16c0eb9d0fb7808f4980e061dc7507c4cd
- https://github.com/rmosolgo/graphql-ruby/commit/2d2f4ed1f79472f8eed29c864b039649e1de238f
- https://github.com/rmosolgo/graphql-ruby/commit/5c5a7b9a9bdce143be048074aea50edb7bb747be
- https://github.com/rmosolgo/graphql-ruby/commit/6eca16b9fa553aa957099a30dbde64ddcdac52ca
- https://github.com/rmosolgo/graphql-ruby/commit/d0963289e0dab4ea893bbecf12bb7d89294957bb
- https://github.com/rmosolgo/graphql-ruby/commit/d1117ae0361d9ed67e0795b07f5c3e98e62f3c7c
- https://github.com/rmosolgo/graphql-ruby/commit/e3b33ace05391da2871c75ab4d3b66e29133b367
- https://about.gitlab.com/releases/2025/03/12/patch-release-gitlab-17-9-2-released
- https://github.com/github-community-projects/graphql-client
- https://github.com/rmosolgo/graphql-ruby/commit/e58676c70aa695e3052ba1fbc787efee4ba7d67e
- https://github.com/rmosolgo/graphql-ruby
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/graphql/CVE-2025-27407.yml
- https://lists.debian.org/debian-lts-announce/2025/08/msg00002.html
Sources
- CVE-2025-27407 · CVE Program
- CVE-2025-27407 · NVD
- FIRST EPSS
- GHSA-q92j-grw3-h492 · GitHub Advisory Database · CC BY 4.0
- CVE-2025-27407 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences