TI-2025-37284 Aliases CVE-2025-59845 GHSA-w87v-7w53-wwxv

Apollo Embedded Sandbox and Explorer vulnerable to CSRF via window.postMessage origin-validation bypass

LOW 35CWE-346Published 2025-09-26 · Updated 2025-09-29

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Security bypass, Tampering
Confidentiality · integrity · availability: Low · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-346 and CWE-352.

Summary

Apollo Studio Embeddable Explorer & Embeddable Sandbox are website embeddable software solutions from Apollo GraphQL. Prior to Apollo Sandbox version 2.7.2 and Apollo Explorer version 3.7.3, a cross-site request forgery (CSRF) vulnerability was identified. The vulnerability arises from missing origin validation in the client-side code that handles window.postMessage events. A malicious website can send forged messages to the embedding page, causing the victim’s browser to execute arbitrary GraphQL queries or mutations against their GraphQL server while authenticated with the victim’s cookies. This issue has been patched in Apollo Sandbox version 2.7.2 and Apollo Explorer version 3.7.3.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00159 5th percentileScored 2026-11-07

Fix Fixed embeddable-explorer (apollographql): 2.7.2, 3.7.3@apollo/sandbox (npm): 2.7.2+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
apollographql	embeddable-explorer	before 2.7.2; before 3.7.3	2.7.2, 3.7.3	Patch available	CNA
—	@apollo/sandbox (npm)	before 2.7.2	2.7.2	Patch available	GHSA-w87v-7w53-wwxv
—	@apollo/explorer (npm)	before 3.7.3	3.7.3	Patch available	GHSA-w87v-7w53-wwxv

embeddable-explorer Vendorapollographql Affected before 2.7.2; before 3.7.3 Fixed in 2.7.2, 3.7.3 Patch available CNA
@apollo/sandbox (npm) Vendor— Affected before 2.7.2 Fixed in 2.7.2 Patch available GHSA-w87v-7w53-wwxv
@apollo/explorer (npm) Vendor— Affected before 3.7.3 Fixed in 3.7.3 Patch available GHSA-w87v-7w53-wwxv

Remediation

Fix · CNA embeddable-explorer (apollographql) Fixed in 2.7.2, 3.7.3
Fix · GHSA-w87v-7w53-wwxv @apollo/sandbox (npm) Fixed in 2.7.2 Advisory →
Fix · GHSA-w87v-7w53-wwxv @apollo/explorer (npm) Fixed in 3.7.3 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2025-59845
2026-10-03 Alias added: GHSA-w87v-7w53-wwxv

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2025-59845

Other 2

TI-2024-21837 Defect in query plan cache may cause incorrect operations to be executed in Apollo Router CVSS 3.1CRITICAL 9.1
TI-2024-29063 Apollo Query Planner and Apollo Gateway may infinitely loop on sufficiently complex queries CVSS 3.1HIGH 7.5
TI-2026-19253 Apollo Server is vulnerable to denial of service with `startStandaloneServer` CVSS 3.1HIGH 7.5
TI-2025-23158 Apollo Router Query Planner Vulnerable to Excessive Resource Consumption via Named Fragment Expansion CVSS 3.1HIGH 7.5
TI-2025-23157 Apollo Router Operation Limits Vulnerable to Bypass via Integer Overflow CVSS 3.1HIGH 7.5
TI-2025-23156 Apollo Router Query Planner Vulnerable to Excessive Resource Consumption via Optimization Bypass CVSS 3.1HIGH 7.5

See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences