CVE-2025-27407: Graphql Remote Code Execution Vulnerability

CRITICAL
Advisory Identifier: GHSA-q92j-grw3-h492
Share
CVSS 9.0
CWE-94
Published
Advisory Summary

CVE-2025-27407 is a CRITICAL (CVSS 9.0) remote code execution vulnerability (CWE-94: Improper Control of Generation of Code ('Code Injection')) affecting Graphql libraries in the RubyGems ecosystem. The issue involves graphql allows remote code execution when loading a crafted graphql schema. Remediation is available by upgrading affected packages to version 2.4.13, 2.3.21, 2.2.17, 2.1.15, 2.0.32, 1.13.24, 1.12.25, 1.11.11.

CVE-2025-27407 at a Glance

CVE Identifier CVE-2025-27407
GHSA Identifier GHSA-q92j-grw3-h492
Severity CRITICAL
CVSS v3.1 Base Score 9.0
CWE Classification CWE-94: Improper Control of Generation of Code ('Code Injection')
Affected Product Graphql
Package Ecosystem RubyGems
Published Date
Last Updated

Security Impact

CVSS: 9.0

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H).

Attack Vector Network (AV:N)
Attack Complexity High (AC:H)
Privileges Required None (PR:N)
User Interaction None (UI:N)
Scope Changed (S:C)
Confidentiality High (C:H)
Integrity High (I:H)
Availability High (A:H)

How to Fix CVE-2025-27407

To remediate this vulnerability, upgrade all affected Graphql dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

graphql fixed: 2.4.13 
Upgrade graphql to 2.4.13
graphql fixed: 2.3.21 
Upgrade graphql to 2.3.21
graphql fixed: 2.2.17 
Upgrade graphql to 2.2.17
graphql fixed: 2.1.15 
Upgrade graphql to 2.1.15
graphql fixed: 2.0.32 
Upgrade graphql to 2.0.32
graphql fixed: 1.13.24 
Upgrade graphql to 1.13.24
graphql fixed: 1.12.25 
Upgrade graphql to 1.12.25
graphql fixed: 1.11.11 
Upgrade graphql to 1.11.11
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

inspect dependencies for graphql

How to Check if You Are Affected

To determine whether your application is affected by CVE-2025-27407, inspect your project dependencies for Graphql:

inspect dependencies for graphql

Analyze the terminal output to locate any version of Graphql in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 2.4.13), your application is affected.

Note: Verify declared build manifests and deployed runtime container environments.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-94: Improper Control of Generation of Code ('Code Injection'), where the product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. In Graphql, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

# Summary Loading a malicious schema definition in `GraphQL::Schema.from_introspection` (or `GraphQL::Schema::Loader.load`) can result in remote code execution. Any system which loads a schema by JSON from an untrusted source is vulnerable, including those that use [GraphQL::Client](https://github.com/github-community-projects/graphql-client) to load external schemas via GraphQL introspection.

CVE-2025-27407 Affected Graphql Versions

8 component(s)
Fixed Versions:
2.4.132.3.212.2.172.1.152.0.321.13.241.12.251.11.11
Product / Package Ecosystem Affected Versions Fixed Version
graphql
gem/graphql
RubyGems
≥ 2.4.0
< 2.4.13
2.4.13
graphql
gem/graphql
RubyGems
≥ 2.3.0
< 2.3.21
2.3.21
graphql
gem/graphql
RubyGems
≥ 2.2.0
< 2.2.17
2.2.17
graphql
gem/graphql
RubyGems
≥ 2.1.0
< 2.1.15
2.1.15
graphql
gem/graphql
RubyGems
≥ 2.0.0
< 2.0.32
2.0.32
graphql
gem/graphql
RubyGems
≥ 1.13.0
< 1.13.24
1.13.24
graphql
gem/graphql
RubyGems
≥ 1.12.0
< 1.12.25
1.12.25
graphql
gem/graphql
RubyGems
≥ 1.11.5
< 1.11.11
1.11.11

References

GitHub Advisory / Wiki ADVISORY
https://github.com/rmosolgo/graphql-ruby/security/advisories/GHSA-q92j-grw3-h492
NVD — CVE-2025-27407 NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-27407
Security Fix Commit FIX COMMIT
https://github.com/rmosolgo/graphql-ruby/commit/28233b16c0eb9d0fb7808f4980e061dc7507c4cd
Security Fix Commit FIX COMMIT
https://github.com/rmosolgo/graphql-ruby/commit/2d2f4ed1f79472f8eed29c864b039649e1de238f
Security Fix Commit FIX COMMIT
https://github.com/rmosolgo/graphql-ruby/commit/5c5a7b9a9bdce143be048074aea50edb7bb747be
Security Fix Commit FIX COMMIT
https://github.com/rmosolgo/graphql-ruby/commit/6eca16b9fa553aa957099a30dbde64ddcdac52ca
Security Fix Commit FIX COMMIT
https://github.com/rmosolgo/graphql-ruby/commit/d0963289e0dab4ea893bbecf12bb7d89294957bb
Security Fix Commit FIX COMMIT
https://github.com/rmosolgo/graphql-ruby/commit/d1117ae0361d9ed67e0795b07f5c3e98e62f3c7c
Security Fix Commit FIX COMMIT
https://github.com/rmosolgo/graphql-ruby/commit/e3b33ace05391da2871c75ab4d3b66e29133b367
Security Fix Commit FIX COMMIT
https://github.com/rmosolgo/graphql-ruby/commit/e58676c70aa695e3052ba1fbc787efee4ba7d67e
about.gitlab.com/releases/2025/03/12... WEB
https://about.gitlab.com/releases/2025/03/12/patch-release-gitlab-17-9-2-released
Graphql Source Repository REPOSITORY
https://github.com/github-community-projects/graphql-client
Graphql Source Repository REPOSITORY
https://github.com/rmosolgo/graphql-ruby
Graphql Source Repository REPOSITORY
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/graphql/CVE-2025-27407.yml
lists.debian.org/debian-lts-announce... WEB
https://lists.debian.org/debian-lts-announce/2025/08/msg00002.html

Frequently Asked Questions

What is CVE-2025-27407?
CVE-2025-27407 is a security vulnerability in Graphql involving graphql allows remote code execution when loading a crafted GraphQL schema under CWE-94: Improper Control of Generation of Code ('Code Injection').
Which Graphql versions are affected?
Affected versions include releases prior to 2.4.13, 2.3.21, 2.2.17, 2.1.15, 2.0.32, 1.13.24, 1.12.25, 1.11.11 across affected packages: graphql.
What version fixes CVE-2025-27407?
Upgrading to 2.4.13, 2.3.21, 2.2.17, 2.1.15, 2.0.32, 1.13.24, 1.12.25, 1.11.11 (or the latest patched release for your respective branch) resolves the vulnerability.
Is graphql affected?
Yes, graphql is affected in releases prior to 2.4.13, 2.3.21, 2.2.17, 2.1.15, 2.0.32, 1.13.24, 1.12.25, 1.11.11. Upgrade your dependency to 2.4.13, 2.3.21, 2.2.17, 2.1.15, 2.0.32, 1.13.24, 1.12.25, 1.11.11 or later.
What is the CVSS score of CVE-2025-27407?
CVE-2025-27407 has a CVSS v3.1 base score of 9.0 (CRITICAL) with vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H.
What CWE is associated with CVE-2025-27407?
CVE-2025-27407 is classified under CWE-94: Improper Control of Generation of Code ('Code Injection') (The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.).
How can I check RubyGems dependencies for CVE-2025-27407?
Run the dependency tree command: 'inspect dependencies for graphql'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-q92j-grw3-h492",
  "modified" : "2025-11-03T21:33:11Z",
  "published" : "2025-03-12T19:28:00Z",
  "aliases" : [ "CVE-2025-27407" ],
  "summary" : "graphql allows remote code execution when loading a crafted GraphQL schema",
  "details" : "# Summary\n\nLoading a malicious schema definition in `GraphQL::Schema.from_introspection` (or `GraphQL::Schema::Loader.load`) can result in remote code execution. Any system which loads a schema by JSON from an untrusted source is vulnerable, including those that use [GraphQL::Client](https://github.com/github-community-projects/graphql-client) to load external schemas via GraphQL introspection.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "RubyGems",
      "name" : "graphql"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "2.4.0"
      }, {
        "fixed" : "2.4.13"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "RubyGems",
      "name" : "graphql"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "2.3.0"
      }, {
        "fixed" : "2.3.21"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "RubyGems",
      "name" : "graphql"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "2.2.0"
      }, {
        "fixed" : "2.2.17"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "RubyGems",
      "name" : "graphql"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "2.1.0"
      }, {
        "fixed" : "2.1.15"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "RubyGems",
      "name" : "graphql"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "2.0.0"
      }, {
        "fixed" : "2.0.32"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "RubyGems",
      "name" : "graphql"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "1.13.0"
      }, {
        "fixed" : "1.13.24"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "RubyGems",
      "name" : "graphql"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "1.12.0"
      }, {
        "fixed" : "1.12.25"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "RubyGems",
      "name" : "graphql"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "1.11.5"
      }, {
        "fixed" : "1.11.11"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/rmosolgo/graphql-ruby/security/advisories/GHSA-q92j-grw3-h492"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2025-27407"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/rmosolgo/graphql-ruby/commit/28233b16c0eb9d0fb7808f4980e061dc7507c4cd"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/rmosolgo/graphql-ruby/commit/2d2f4ed1f79472f8eed29c864b039649e1de238f"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/rmosolgo/graphql-ruby/commit/5c5a7b9a9bdce143be048074aea50edb7bb747be"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/rmosolgo/graphql-ruby/commit/6eca16b9fa553aa957099a30dbde64ddcdac52ca"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/rmosolgo/graphql-ruby/commit/d0963289e0dab4ea893bbecf12bb7d89294957bb"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/rmosolgo/graphql-ruby/commit/d1117ae0361d9ed67e0795b07f5c3e98e62f3c7c"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/rmosolgo/graphql-ruby/commit/e3b33ace05391da2871c75ab4d3b66e29133b367"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/rmosolgo/graphql-ruby/commit/e58676c70aa695e3052ba1fbc787efee4ba7d67e"
  }, {
    "type" : "WEB",
    "url" : "https://about.gitlab.com/releases/2025/03/12/patch-release-gitlab-17-9-2-released"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/github-community-projects/graphql-client"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/rmosolgo/graphql-ruby"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/graphql/CVE-2025-27407.yml"
  }, {
    "type" : "WEB",
    "url" : "https://lists.debian.org/debian-lts-announce/2025/08/msg00002.html"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-94" ],
    "severity" : "CRITICAL",
    "github_reviewed" : true,
    "github_reviewed_at" : "2025-03-12T19:28:00Z",
    "nvd_published_at" : "2025-03-12T19:15:40Z"
  }
}