Lucene search
+L
Catalog
Vendors
Products
Timeline
Vulnerabilities
Sources
Documentation
Blog
Glossary
FAQ
Brand assets
Assessment
Agents dashboard
Agent Scanning
API Scanning
Assessment API
Alerts
Email notifications
Webhook notifications
Alerts API
SBOM package analysis
API Reference
Support
Settings
Sign in

graphql-ruby: Remote code execution when loading a crafted GraphQL schema

🗓️ 01 Apr 2025 15:20:14Reported by RedHatType 
redhat
 redhat🔗 access.redhat.com👁 18 Views

GraphQL-Ruby remote code execution from loading a crafted schema in untrusted JSON via from_introspection or Loader.load.

Related
Packages
Refs
ReporterTitlePublishedViews
Family
FreeBSD		Gitlab -- Vulnerabilities
12 Mar 202500:00
–freebsd
BDU FSTEC		The vulnerability in the GraphQL library for Ruby and the git-based software platform for collaborative code development on GitLab CE/EE arises from improper code generation management. This vulnerability allows a perpetrator to execute arbitrary code.
17 Mar 202500:00
–bdu_fstec
GithubExploit		Exploit for CVE-2025-27407
25 Apr 202604:33
–githubexploit
GithubExploit		Exploit for CVE-2025-27407
26 Dec 202518:14
–githubexploit
Circl		CVE-2025-27407
12 Mar 202519:21
–circl
CNNVD		GraphQL 安全漏洞
12 Mar 202500:00
–cnnvd
CVE		CVE-2025-27407
12 Mar 202518:15
–cve
Cvelist		CVE-2025-27407 Remote code execution when loading a crafted GraphQL schema
12 Mar 202518:15
–cvelist
Debian		[SECURITY] [DLA 4263-1] ruby-graphql security update
4 Aug 202501:11
–debian
Debian CVE		CVE-2025-27407
12 Mar 202518:15
–debiancve
Rows per page
OSOS VersionArchitecturePackagePackage VersionFilename
Red Hat Enterprise Linux8noarchrubygem-graphql1.13.24-1.el8satrubygem-graphql-1.13.24-1.el8sat.noarch.rpm
Red Hat Enterprise Linux9noarchrubygem-graphql1.13.24-1.el9satrubygem-graphql-1.13.24-1.el9sat.noarch.rpm
SourceLink
accesswww.access.redhat.com/security/cve/CVE-2025-27407
bugzillawww.bugzilla.redhat.com/show_bug.cgi
githubwww.github.com/github-community-projects/graphql-client
githubwww.github.com/rmosolgo/graphql-ruby/commit/28233b16c0eb9d0fb7808f4980e061dc7507c4cd
githubwww.github.com/rmosolgo/graphql-ruby/commit/2d2f4ed1f79472f8eed29c864b039649e1de238f
githubwww.github.com/rmosolgo/graphql-ruby/commit/5c5a7b9a9bdce143be048074aea50edb7bb747be
githubwww.github.com/rmosolgo/graphql-ruby/commit/6eca16b9fa553aa957099a30dbde64ddcdac52ca
githubwww.github.com/rmosolgo/graphql-ruby/commit/d0963289e0dab4ea893bbecf12bb7d89294957bb
githubwww.github.com/rmosolgo/graphql-ruby/commit/d1117ae0361d9ed67e0795b07f5c3e98e62f3c7c
githubwww.github.com/rmosolgo/graphql-ruby/commit/e3b33ace05391da2871c75ab4d3b66e29133b367
Rows per page

Data

Build on a solid foundation with Vulners data

We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data

Api

Power your application with Vulners API

The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access

App

Assess and manage vulnerabilities with Vulners tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation

Book a live demo
11 Jul 2026 20:20Current
6.1Medium risk
Vulners AI Score6.1
CVSS 3.19
EPSS0.02865
SSVC
CWE-94
GraphQL RubyRemote Code ExecutionUntrusted JSONSchema LoadingIntrospection
18