CVE-2025-27407 Details
Description
graphql-ruby is a Ruby implementation of GraphQL. Starting in version 1.11.5 and prior to versions 1.11.8, 1.12.25, 1.13.24, 2.0.32, 2.1.14, 2.2.17, and 2.3.21, loading a malicious schema definition in `GraphQL::Schema.from_introspection` (or `GraphQL::Schema::Loader.load`) can result in remote code execution. Any system which loads a schema by JSON from an untrusted source is vulnerable, including those that use GraphQL::Client to load external schemas via GraphQL introspection. Versions 1.11.8, 1.12.25, 1.13.24, 2.0.32, 2.1.14, 2.2.17, and 2.3.21 contain a patch for the issue.
A remote code execution vulnerability exists in the GraphQL Ruby library, specifically in versions 1.11.5 prior to 1.11.8, 1.12.25, 1.13.24, 2.0.32, 2.1.14, 2.2.17, and 2.3.21. The issue arises when a malicious schema is loaded via 'GraphQL::Schema.from_introspection' or 'GraphQL::Schema::Loader.load'. Systems that use the 'graphql-client' gem to load external schemas through GraphQL introspection are also vulnerable. The vulnerability can be exploited by any authenticated user who transfers a crafted project using the Direct Transfer feature, which is in beta and off by default for self-managed GitLab instances.
Upgrade to GraphQL Ruby versions 1.11.8, 1.12.25, 1.13.24, 2.0.32, 2.1.14, 2.2.17, or 2.3.21.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Mar 12, 2025CISA-ADP
Assessed Mar 12, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| graphql-ruby | All versions |
CPE
Remediation
| |
| graphql-client | All versions |
CPE
Remediation
| |
| graphql | >= 2.4.0, < 2.4.13 (semver) >= 2.3.0, < 2.3.21 (semver) >= 2.2.0, < 2.2.17 (semver) >= 2.1.0, < 2.1.15 (semver) >= 2.0.0, < 2.0.32 (semver) >= 1.13.0, < 1.13.24 (semver) >= 1.12.0, < 1.12.25 (semver) >= 1.11.5, < 1.11.11 (semver) |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Nov 3, 2025 | CVE Modified | CVE |
| Mar 12, 2025 | CVE Modified | [email protected] |
| Mar 12, 2025 | New CVE Received | [email protected] |