CVE-2025-27407

Published Mar 12, 2025

Last updated 4 months ago

CVSS critical 9.0
graphql

Overview

Description
graphql-ruby is a Ruby implementation of GraphQL. Starting in version 1.11.5 and prior to versions 1.11.8, 1.12.25, 1.13.24, 2.0.32, 2.1.14, 2.2.17, and 2.3.21, loading a malicious schema definition in `GraphQL::Schema.from_introspection` (or `GraphQL::Schema::Loader.load`) can result in remote code execution. Any system which loads a schema by JSON from an untrusted source is vulnerable, including those that use GraphQL::Client to load external schemas via GraphQL introspection. Versions 1.11.8, 1.12.25, 1.13.24, 2.0.32, 2.1.14, 2.2.17, and 2.3.21 contain a patch for the issue.
Source
security-advisories@github.com
NVD status
Awaiting Analysis

Risk scores

CVSS 3.1

Type
Secondary
Base score
9
Impact score
6
Exploitability score
2.2
Vector string
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Severity
CRITICAL

Weaknesses

security-advisories@github.com
CWE-94

Social media

Hype score
Not currently trending

  1. CVE-2025-27407: Inside the Critical GraphQL-Ruby RCE Vulnerability https://t.co/GhZF3OdjzS

    @CenobeSecurity

    26 Mar 2025

    16 Impressions

    1 Retweet

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

  2. 🚨 Vulnerabilidad crítica en GraphQL-Ruby expone a millones a RCE ⚠️ CVE-2025-27407 (CVSS 9.1) https://t.co/bQiGulq0NV https://t.co/NBEewabta6

    @elhackernet

    18 Mar 2025

    2133 Impressions

    6 Retweets

    9 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  3. CVE-2025-27407 (CVSS 9.1): Critical GraphQL-Ruby Flaw Exposes Millions to RCE https://t.co/wJH4l04HHq

    @Dinosn

    17 Mar 2025

    2194 Impressions

    5 Retweets

    12 Likes

    13 Bookmarks

    0 Replies

    0 Quotes

  4. 🚨 CVE-2025-27407 ⚠️🔴 CRITICAL (9.1) 🏢 rmosolgo - graphql-ruby 🏗️ >= 1.11.5, < 1.11.8 🔗 https://t.co/wMPUHoRFJN 🔗 https://t.co/ozngNlvG8D 🔗 https://t.co/QbXgKYkVNx 🔗 https://t.co/hdmcKzjDha 🔗 https://t.co/blpegBWEhL 🔗 https://t.co/gKfWhWqROs #CyberCron #VulnAlert #

    @cybercronai

    14 Mar 2025

    18 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  5. ⚠️ Vulnerability Alert: GitLab Login Vulnerabilities 📅 Timeline: Disclosure: 2025-03-12, Patch: 2025-03-12 📌 Attribution: GitLab Security Team 🆔 cveId: CVE-2025-25291, CVE-2025-25292, CVE-2025-27407 📊 baseScore: • CVE-2025-25291: 9.8 (Critical) • CVE-2025-25292: 9.8… https:/

    @syedaquib77

    13 Mar 2025

    29 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  6. Remote code execution when loading a crafted GraphQL schema (CVE-2025-27407) #CVE202527407 #GraphQL #RemoteCodeExecutionVulnerability https://t.co/Cscjvah9Pu https://t.co/NiLUMIsDn5

    @SystemTek_UK

    13 Mar 2025

    25 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  7. New post from https://t.co/uXvPWJy6tj (CVE-2025-27407 | rmosolgo graphql-ruby up to 2.3.20 Loader.load code injection (GHSA-q92j-grw3-h492)) has been published on https://t.co/AyNny46p9W

    @WolfgangSesin

    13 Mar 2025

    9 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  8. New post from https://t.co/uXvPWJy6tj (CVE-2025-27407 | rmosolgo graphql-ruby up to 2.3.20 Loader.load code injection (GHSA-q92j-grw3-h492)) has been published on https://t.co/EZwsFZFsaN

    @WolfgangSesin

    13 Mar 2025

    11 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  9. [CVE-2025-27407: CRITICAL] GraphQL-ruby, a Ruby implementation of GraphQL, had a security vulnerability allowing remote code execution before versions 1.11.8, 1.12.25, 1.13.24, 2.0.32, 2.1.14, 2.2.17, and 2.3.21.#cybersecurity,#vulnerability https://t.co/azMDq8D5zS https://t.co/s

    @CveFindCom

    12 Mar 2025

    25 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

Related CVEs

  1. Craft is a content management system (CMS). In versions 4.5.0-RC1 through 4.16.18 and 5.0.0-RC1 through 5.8.22, a Time-of-Check-Time-of-Use (TOCTOU) race condition exists in Craft CMS’s token validation service for tokens that explicitly set a limited usage. The `getTokenRoute()` method reads a token’s usage count, checks if it’s within limits, then updates the database in separate non-atomic operations. By sending concurrent requests, an attacker can use a single-use impersonation token multiple times before the database update completes. To make this work, an attacker needs to obtain a valid user account impersonation URL with a non-expired token via some other means and exploit a race condition while bypassing any rate-limiting rules in place. For this to be a privilege escalation, the impersonation URL must include a token for a user account with more permissions than the current user. Versions 4.16.19 and 5.8.23 patch the issue.•CVE-2026-27128
  2. GitLab has remediated an issue in GitLab EE affecting all versions from 15.6 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that could have allowed an authenticated user to cause Denial of Service by uploading a malicious file and repeatedly querying it through GraphQl.•CVE-2026-1387
  3. GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that, under certain conditions could have allowed an authenticated user to perform unauthorized operations by submitting GraphQL mutations through the GLQL API endpoint.•CVE-2025-14592
  4. Apollo Server is an open-source, spec-compliant GraphQL server that's compatible with any GraphQL client, including Apollo Client. In versions from 2.0.0 to 3.13.0, 4.2.0 to before 4.13.0, and 5.0.0 to before 5.4.0, the default configuration of startStandaloneServer from @apollo/server/standalone is vulnerable to denial of service (DoS) attacks through specially crafted request bodies with exotic character set encodings. This issue does not affect users that use @apollo/server as a dependency for integration packages, like @as-integrations/express5 or @as-integrations/next, only direct usage of startStandaloneServer.•CVE-2026-23897
  5. GraphQL Modules is a toolset of libraries and guidelines dedicated to create reusable, maintainable, testable and extendable modules out of your GraphQL server. From 2.2.1 to before 2.4.1 and 3.1.1, when 2 or more parallel requests are made which trigger the same service, the context of the requests is mixed up in the service when the context is injected via @ExecutionContext(). ExecutionContext is often used to pass authentication tokens from incoming requests to services loading data from backend APIs. This vulnerability is fixed in 2.4.1 and 3.1.1.•CVE-2026-23735

References

Sources include official advisories and independent security research.