CVE-2025-27407: (third party gem graphql)
Summary
Loading a malicious schema definition in GraphQL::Schema.fromintrospection (or GraphQL::Schema::Loader.load) can result in remote code execution. Any system which loads a schema by JSON from an untrusted source is vulnerable, including those that use GraphQL::Client to load external schemas via GraphQL introspection.
Other sources
GitLab has remediated a privately disclosed security issue (CVE-2025-27407) identified in the Ruby graphql library, which affects and has been remediated in GitLab.com, and in GitLab CE/EE versions 17.7.7, 17.8.5, and 17.9.2.
— GitLab
graphql-ruby is a Ruby implementation of GraphQL. Starting in version 1.11.5 and prior to versions 1.11.8, 1.12.25, 1.13.24, 2.0.32, 2.1.14, 2.2.17, and 2.3.21, loading a malicious schema definition in GraphQL::Schema.fromintrospection (or GraphQL::Schema::Loader.load) can result in remote code execution. Any system which loads a schema by JSON from an untrusted source is vulnerable, including those that use GraphQL::Client to load external schemas via GraphQL introspection. Versions 1.11.8, 1.12.25, 1.13.24, 2.0.32, 2.1.14, 2.2.17, and 2.3.21 contain a patch for the issue.
— NVD
Affected Software
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2025-27407?
CVE-2025-27407 has been classified with a severity level indicating potential impact due to the loading of a malicious schema.
How do I fix CVE-2025-27407?
To fix CVE-2025-27407, upgrade to versions 1.11.8, 1.12.25, 1.13.24, 2.0.32, 2.1.14, 2.2.17, or 2.3.21 of graphql-ruby.
Which versions of graphql-ruby are affected by CVE-2025-27407?
The affected versions of graphql-ruby range from 1.11.5 to 1.11.8, from 1.12.0 to 1.12.25, and several other specific versions until 2.3.21.
What kind of vulnerability is CVE-2025-27407?
CVE-2025-27407 is a vulnerability related to the unsafe loading of malicious schema definitions in the graphql-ruby implementation.
Is there a specific method that is vulnerable in CVE-2025-27407?
Yes, the methods `GraphQL::Schema.from_introspection` and `GraphQL::Schema::Loader.load` are specifically vulnerable in CVE-2025-27407.