Every CVE Search/ Get API key

CVE-2025-27407

Remote code execution when loading a crafted GraphQL schema

9.1 CriticalPublic exploitFix available

graphql-ruby is a Ruby implementation of GraphQL. Starting in version 1.11.5 and prior to versions 1.11.8, 1.12.25, 1.13.24, 2.0.32, 2.1.14, 2.2.17, and 2.3.21, loading a malicious schema definition in GraphQL::Schema.from_introspection (or GraphQL::Schema::Loader.load) can result in remote code execution. Any system which loads a schema by JSON from an untrusted source is vulnerable, including those that use GraphQL::Client to load external schemas via GraphQL introspection. Versions 1.11.8, 1.12.25, 1.13.24, 2.0.32, 2.1.14, 2.2.17, and 2.3.21 contain a patch for the issue.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

3.10%Up 3.1 points since Mar 13, 2025
90%50%10%1%

What each source reports

CVE List Score used 9.1

Remote code execution when loading a crafted GraphQL schema

graphql-ruby is a Ruby implementation of GraphQL. Starting in version 1.11.5 and prior to versions 1.11.8, 1.12.25, 1.13.24, 2.0.32, 2.1.14, 2.2.17, and 2.3.21, loading a malicious schema definition in GraphQL::Schema.from_introspection (or GraphQL::Schema::Loader.load) can result in remote code execution. Any system which loads a schema by JSON from an untrusted source is vulnerable, including those that use GraphQL::Client to load external schemas via GraphQL introspection. Versions 1.11.8, 1.12.25, 1.13.24, 2.0.32, 2.1.14, 2.2.17, and 2.3.21 contain a patch for the issue.

Record
CVE-2025-27407
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness
CWE-94
Updated
2026-11-02
EUVDEUVD-2025-7224 9.1

graphql-ruby is a Ruby implementation of GraphQL. Starting in version 1.11.5 and prior to versions 1.11.8, 1.12.25, 1.13.24, 2.0.32, 2.1.14, 2.2.17, and 2.3.21, loading a malicious schema definition in GraphQL::Schema.from_introspection (or GraphQL::Schema::Loader.load) can result in remote code execution. Any system which loads a schema by JSON from an untrusted source is vulnerable, including those that use GraphQL::Client to load external schemas via GraphQL introspection. Versions 1.11.8, 1.12.25, 1.13.24, 2.0.32, 2.1.14, 2.2.17, and 2.3.21 contain a patch for the issue.

Record
EUVD-2025-7224
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-q92j-grw3-h492 9.0

graphql allows remote code execution when loading a crafted GraphQL schema

Summary

Loading a malicious schema definition in GraphQL::Schema.from_introspection (or GraphQL::Schema::Loader.load) can result in remote code execution. Any system which loads a schema by JSON from an untrusted source is vulnerable, including those that use GraphQL::Client to load external schemas via GraphQL introspection.

Record
GHSA-q92j-grw3-h492
CVSS 3.1
9.0 CriticalCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness
CWE-94
Updated
2026-11-02
NVD 9.0

graphql-ruby is a Ruby implementation of GraphQL. Starting in version 1.11.5 and prior to versions 1.11.8, 1.12.25, 1.13.24, 2.0.32, 2.1.14, 2.2.17, and 2.3.21, loading a malicious schema definition in GraphQL::Schema.from_introspection (or GraphQL::Schema::Loader.load) can result in remote code execution. Any system which loads a schema by JSON from an untrusted source is vulnerable, including those that use GraphQL::Client to load external schemas via GraphQL introspection. Versions 1.11.8, 1.12.25, 1.13.24, 2.0.32, 2.1.14, 2.2.17, and 2.3.21 contain a patch for the issue.

Record
CVE-2025-27407
CVSS 3.1
9.0 CriticalCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness
CWE-94
Updated
2026-11-02
OSV 9.0

Remote code execution when loading a crafted GraphQL schema

graphql-ruby is a Ruby implementation of GraphQL. Starting in version 1.11.5 and prior to versions 1.11.8, 1.12.25, 1.13.24, 2.0.32, 2.1.14, 2.2.17, and 2.3.21, loading a malicious schema definition in GraphQL::Schema.from_introspection (or GraphQL::Schema::Loader.load) can result in remote code execution. Any system which loads a schema by JSON from an untrusted source is vulnerable, including those that use GraphQL::Client to load external schemas via GraphQL introspection. Versions 1.11.8, 1.12.25, 1.13.24, 2.0.32, 2.1.14, 2.2.17, and 2.3.21 contain a patch for the issue.

Record
CVE-2025-27407
CVSS 3.1
9.0 CriticalCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness
CWE-94
Updated
2026-11-02
OSVDEBIAN-CVE-2025-27407 9.0

graphql-ruby is a Ruby implementation of GraphQL. Starting in version 1.11.5 and prior to versions 1.11.8, 1.12.25, 1.13.24, 2.0.32, 2.1.14, 2.2.17, and 2.3.21, loading a malicious schema definition in GraphQL::Schema.from_introspection (or GraphQL::Schema::Loader.load) can result in remote code execution. Any system which loads a schema by JSON from an untrusted source is vulnerable, including those that use GraphQL::Client to load external schemas via GraphQL introspection. Versions 1.11.8, 1.12.25, 1.13.24, 2.0.32, 2.1.14, 2.2.17, and 2.3.21 contain a patch for the issue.

Record
DEBIAN-CVE-2025-27407
CVSS 3.1
9.0 CriticalCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
Show 6 moreShow less
OSVGHSA-q92j-grw3-h492 9.0

graphql allows remote code execution when loading a crafted GraphQL schema

Summary

Loading a malicious schema definition in GraphQL::Schema.from_introspection (or GraphQL::Schema::Loader.load) can result in remote code execution. Any system which loads a schema by JSON from an untrusted source is vulnerable, including those that use GraphQL::Client to load external schemas via GraphQL introspection.

Record
GHSA-q92j-grw3-h492
CVSS 3.1
9.0 CriticalCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness
CWE-94
Updated
2026-11-02
OSVRHSA-2025:3490 8.5

Red Hat Security Advisory: Satellite 6.16.4 Async Update

Record
RHSA-2025:3490
CVSS 3.1
8.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2025:3491 8.5

Red Hat Security Advisory: Satellite 6.15.5.2 Async Update

Record
RHSA-2025:3491
CVSS 3.1
8.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2025:3492 8.5

Red Hat Security Advisory: Satellite 6.14.4.5 Async Update

Record
RHSA-2025:3492
CVSS 3.1
8.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2025:4576 8.5

Red Hat Security Advisory: Satellite 6.17.0 release

Record
RHSA-2025:4576
CVSS 3.1
8.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2025-27407 9.0

graphql-ruby is a Ruby implementation of GraphQL. Starting in version 1.11.5 and prior to versions 1.11.8, 1.12.25, 1.13.24, 2.0.32, 2.1.14, 2.2.17, and 2.3.21, loading a malicious schema definition in GraphQL::Schema.from_introspection (or GraphQL::Schema::Loader.load) can result in remote code execution. Any system which loads a schema by JSON from an untrusted source is vulnerable, including those that use GraphQL::Client to load external schemas via GraphQL introspection. Versions 1.11.8, 1.12.25, 1.13.24, 2.0.32, 2.1.14, 2.2.17, and 2.3.21 contain a patch for the issue.

Record
UBUNTU-CVE-2025-27407
CVSS 3.1
9.0 CriticalCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
graphql
RubyGems
 2.4.0 up to 2.4.13
2.4.13
graphql
RubyGems
 2.3.0 up to 2.3.21
2.3.21
graphql
RubyGems
 2.0.0 up to 2.0.32
2.0.32
graphql
RubyGems
 1.13.0 up to 1.13.24
1.13.24
graphql
RubyGems
 1.12.0 up to 1.12.25
1.12.25
graphql
RubyGems
 2.1.0 up to 2.1.15
2.1.15
graphql
RubyGems
 1.11.5 up to 1.11.11
1.11.11
graphql
RubyGems
 2.2.0 up to 2.2.17
2.2.17
ruby-graphql
Debian:12
 All versions, plus listed versions
1.13.15-11.13.20-12.2.17-12.2.5-12.2.5-2
Show 7 moreShow less
2.2.5-32.5.19-12.5.20-12.6.0-12.6.3-12.6.6-12.6.9-1
 None known
ruby-graphql
Debian:13
 before 2.2.17-1
2.2.17-1
Show 43 moreShow less
Affected packages
PackageAffectedFixed
ruby-graphql
Debian:14
 before 2.2.17-1
2.2.17-1
ruby-graphql
Debian:11
 before 1.11.12-0+deb11u1, plus listed versions
1.11.10-11.11.4-11.11.8-11.11.8-21.11.8-3
1.11.12-0+deb11u1
graphql
RubyGems
 2.4.0 up to 2.4.13, plus listed versions
2.4.12.4.102.4.112.4.122.4.2
Show 7 moreShow less
2.4.32.4.42.4.52.4.62.4.72.4.82.4.9
2.4.13
graphql
RubyGems
 2.3.0 up to 2.3.21, plus listed versions
2.3.12.3.102.3.112.3.122.3.13
Show 15 moreShow less
2.3.142.3.152.3.162.3.172.3.182.3.192.3.22.3.202.3.32.3.42.3.52.3.62.3.72.3.82.3.9
2.3.21
graphql
RubyGems
 2.2.0 up to 2.2.17, plus listed versions
2.2.12.2.102.2.112.2.122.2.13
Show 11 moreShow less
2.2.142.2.152.2.162.2.22.2.32.2.42.2.52.2.62.2.72.2.82.2.9
2.2.17
graphql
RubyGems
 2.1.0 up to 2.1.15, plus listed versions
2.1.12.1.102.1.112.1.122.1.13
Show 8 moreShow less
2.1.22.1.32.1.42.1.52.1.62.1.72.1.82.1.9
2.1.15
graphql
RubyGems
 2.0.0 up to 2.0.32, plus listed versions
2.0.12.0.112.0.122.0.132.0.14
Show 27 moreShow less
2.0.152.0.162.0.172.0.17.12.0.17.22.0.182.0.192.0.22.0.202.0.212.0.222.0.232.0.242.0.252.0.262.0.272.0.282.0.292.0.32.0.302.0.312.0.42.0.52.0.62.0.72.0.82.0.9
2.0.32
graphql
RubyGems
 1.13.0 up to 1.13.24, plus listed versions
1.13.11.13.101.13.111.13.121.13.13
Show 18 moreShow less
1.13.141.13.151.13.161.13.171.13.181.13.191.13.21.13.201.13.211.13.221.13.231.13.31.13.41.13.51.13.61.13.71.13.81.13.9
1.13.24
graphql
RubyGems
 1.12.0 up to 1.12.25, plus listed versions
1.12.11.12.101.12.111.12.121.12.13
Show 19 moreShow less
1.12.141.12.151.12.161.12.171.12.181.12.191.12.21.12.201.12.211.12.221.12.231.12.241.12.31.12.41.12.51.12.61.12.71.12.81.12.9
1.12.25
graphql
RubyGems
 1.11.5 up to 1.11.11, plus listed versions
1.11.101.11.61.11.71.11.81.11.9
1.11.11
rubygem-graphql
Red Hat:satellite:6.16::el8
From an advisory covering 2 CVEs
 before 0:1.13.24-1.el8sat
0:1.13.24-1.el8sat
rubygem-graphql
Red Hat:satellite:6.16::el9
From an advisory covering 2 CVEs
 before 0:1.13.24-1.el9sat
0:1.13.24-1.el9sat
rubygem-rack
Red Hat:satellite_capsule:6.16::el8
From an advisory covering 2 CVEs
 before 0:2.2.13-1.el8sat
0:2.2.13-1.el8sat
rubygem-rack
Red Hat:satellite:6.16::el8
From an advisory covering 2 CVEs
 before 0:2.2.13-1.el8sat
0:2.2.13-1.el8sat
rubygem-rack
Red Hat:satellite_capsule:6.16::el9
From an advisory covering 2 CVEs
 before 0:2.2.13-1.el9sat
0:2.2.13-1.el9sat
rubygem-rack
Red Hat:satellite:6.16::el9
From an advisory covering 2 CVEs
 before 0:2.2.13-1.el9sat
0:2.2.13-1.el9sat
python-jinja2
Red Hat:satellite_capsule:6.15::el8
From an advisory covering 3 CVEs
 before 0:3.1.5-1.el8pc
0:3.1.5-1.el8pc
python3.11-jinja2
Red Hat:satellite_capsule:6.15::el8
From an advisory covering 3 CVEs
 before 0:3.1.5-1.el8pc
0:3.1.5-1.el8pc
python-jinja2
Red Hat:satellite:6.15::el8
From an advisory covering 3 CVEs
 before 0:3.1.5-1.el8pc
0:3.1.5-1.el8pc
python3.11-jinja2
Red Hat:satellite:6.15::el8
From an advisory covering 3 CVEs
 before 0:3.1.5-1.el8pc
0:3.1.5-1.el8pc
rubygem-graphql
Red Hat:satellite:6.15::el8
From an advisory covering 3 CVEs
 before 0:1.13.24-1.el8sat
0:1.13.24-1.el8sat
rubygem-rack
Red Hat:satellite_capsule:6.15::el8
From an advisory covering 3 CVEs
 before 0:2.2.13-1.el8sat
0:2.2.13-1.el8sat
rubygem-rack
Red Hat:satellite:6.15::el8
From an advisory covering 3 CVEs
 before 0:2.2.13-1.el8sat
0:2.2.13-1.el8sat
rubygem-graphql
Red Hat:satellite:6.14::el8
From an advisory covering 2 CVEs
 before 0:1.13.24-1.el8sat
0:1.13.24-1.el8sat
rubygem-rack
Red Hat:satellite_capsule:6.14::el8
From an advisory covering 2 CVEs
 before 0:2.2.13-1.el8sat
0:2.2.13-1.el8sat
rubygem-rack
Red Hat:satellite:6.14::el8
From an advisory covering 2 CVEs
 before 0:2.2.13-1.el8sat
0:2.2.13-1.el8sat
python-jinja2
Red Hat:satellite_capsule:6.17::el9
From an advisory covering 4 CVEs
 before 0:3.1.5-1.el9pc
0:3.1.5-1.el9pc
python3.11-jinja2
Red Hat:satellite_capsule:6.17::el9
From an advisory covering 4 CVEs
 before 0:3.1.5-1.el9pc
0:3.1.5-1.el9pc
python-jinja2
Red Hat:satellite:6.17::el9
From an advisory covering 4 CVEs
 before 0:3.1.5-1.el9pc
0:3.1.5-1.el9pc
python3.11-jinja2
Red Hat:satellite:6.17::el9
From an advisory covering 4 CVEs
 before 0:3.1.5-1.el9pc
0:3.1.5-1.el9pc
python-django
Red Hat:satellite_capsule:6.17::el9
From an advisory covering 4 CVEs
 before 0:4.2.19-1.el9pc
0:4.2.19-1.el9pc
python3.11-django
Red Hat:satellite_capsule:6.17::el9
From an advisory covering 4 CVEs
 before 0:4.2.19-1.el9pc
0:4.2.19-1.el9pc
python-django
Red Hat:satellite:6.17::el9
From an advisory covering 4 CVEs
 before 0:4.2.19-1.el9pc
0:4.2.19-1.el9pc
python3.11-django
Red Hat:satellite:6.17::el9
From an advisory covering 4 CVEs
 before 0:4.2.19-1.el9pc
0:4.2.19-1.el9pc
rubygem-graphql
Red Hat:satellite:6.17::el9
From an advisory covering 4 CVEs
 before 0:1.13.24-1.el9sat
0:1.13.24-1.el9sat
rubygem-rack
Red Hat:satellite_capsule:6.17::el9
From an advisory covering 4 CVEs
 before 0:2.2.13-1.el9sat
0:2.2.13-1.el9sat
rubygem-rack
Red Hat:satellite:6.17::el9
From an advisory covering 4 CVEs
 before 0:2.2.13-1.el9sat
0:2.2.13-1.el9sat
ruby-graphql
Ubuntu:20.04:LTS
 All versions, plus listed versions
1.8.4-11.9.16-11.9.19-1
 None known
ruby-graphql
Ubuntu:22.04:LTS
 All versions, plus listed versions
1.11.4-11.11.8-31.11.10-1
 None known
ruby-graphql
Ubuntu:24.04:LTS
 All versions, plus listed versions
1.13.15-11.13.20-12.2.5-3
 None known
ruby-graphql
Ubuntu:25.10
 All versions, plus listed versions
2.2.5-32.2.17-1
 None known
ruby-graphql
Ubuntu:26.10
 All versions, plus listed versions
2.5.19-12.6.0-12.6.3-12.6.6-1
 None known
ruby-graphql
Ubuntu:26.04:LTS
 All versions, plus listed versions
2.2.17-12.5.19-1
 None known

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubLoGGGG2402/CVE-2025-274072026-04-25

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-27407 is a critical vulnerability (CVSS 9.1) in Rmosolgo Graphql-ruby, published March 12, 2025. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 3.10%, the 87th percentile. Fixed in graphql 2.4.13.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 98 references. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open