PT-2025-11114 · Unknown+1 · Graphql-Ruby+1

Rmosolgo + 1 · Published 2025-03-12 · Updated 2026-01-12 · CVE-2025-27407

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions graphql-ruby versions 1.11.5 through 1.11.7 graphql-ruby versions 1.12.0 through 1.12.24 graphql-ruby versions 1.13.0 through 1.13.23 graphql-ruby versions 2.0.0 through 2.0.31 graphql-ruby versions 2.1.0 through 2.1.13 graphql-ruby versions 2.2.0 through 2.2.16 graphql-ruby versions 2.3.0 through 2.3.20

Description The issue allows remote code execution when loading a crafted GraphQL schema. Any system that loads a schema by JSON from an untrusted source is vulnerable, including those that use GraphQL::Client to load external schemas via GraphQL introspection. The vulnerability is related to the GraphQL::Schema.from introspection and GraphQL::Schema::Loader.load functions.

Recommendations For versions 1.11.5 through 1.11.7, update to version 1.11.8 or later. For versions 1.12.0 through 1.12.24, update to version 1.12.25 or later. For versions 1.13.0 through 1.13.23, update to version 1.13.24 or later. For versions 2.0.0 through 2.0.31, update to version 2.0.32 or later. For versions 2.1.0 through 2.1.13, update to version 2.1.14 or later. For versions 2.2.0 through 2.2.16, update to version 2.2.17 or later. For versions 2.3.0 through 2.3.20, update to version 2.3.21 or later. As a temporary workaround, consider restricting access to the GraphQL::Schema.from introspection and GraphQL::Schema::Loader.load functions to minimize the risk of exploitation.

Exploit

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

BDU:2025-02819

CVE-2025-27407

DLA-4263-1

GHSA-Q92J-GRW3-H492

RHSA-2025:3490

RHSA-2025:3491

RHSA-2025:3492

RHSA-2025:4576

Affected Products

Debian

Graphql-Ruby

References · 50

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/27xxx/CVE-2025-27407.json · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/graphql/CVE-2025-27407.yml · Exploit
• https://osv.dev/vulnerability/GHSA-q92j-grw3-h492 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-27407 · Security Note
• https://ubuntu.com/security/CVE-2025-27407 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-4263-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-02819 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-27407 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-27407 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-27407 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-27407 · Security Note
• https://osv.dev/vulnerability/CVE-2025-27407 · Vendor Advisory
• https://github.com/rmosolgo/graphql-ruby · Note
• https://github.com/rmosolgo/graphql-ruby/commit/6eca16b9fa553aa957099a30dbde64ddcdac52ca · Note
• https://github.com/rmosolgo/graphql-ruby/commit/28233b16c0eb9d0fb7808f4980e061dc7507c4cd · Note