com.squareup.wire:wire-grpc-client (4.5.5), com.squareup.wire:wire-schema (4.5.5) +3 more potentially affected by CVE-2024-58103 via com.squareup.wire:wire-runtime (4.5.5)

com.squareup.wire:wire-runtime MAVEN version 4.5.5 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-grpc-client 4.5.5 - com.squareup.wire:wire-schema 4.5.5 -...

com.squareup.wire:wire-grpc-client (4.5.6), com.squareup.wire:wire-schema (4.5.6) potentially affected by CVE-2024-58103 via com.squareup.wire:wire-runtime (4.5.6)

com.squareup.wire:wire-runtime MAVEN version 4.5.6 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-grpc-client 4.5.6 - com.squareup.wire:wire-schema 4.5.6 Source cves:...

com.squareup.wire:wire-grpc-client (4.6.0), com.squareup.wire:wire-schema (4.6.0) potentially affected by CVE-2024-58103 via com.squareup.wire:wire-runtime (4.6.0)

com.squareup.wire:wire-runtime MAVEN version 4.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-grpc-client 4.6.0 - com.squareup.wire:wire-schema 4.6.0 Source cves:...

com.squareup.wire:wire-grpc-client (4.6.1), com.squareup.wire:wire-schema (4.6.1) potentially affected by CVE-2024-58103 via com.squareup.wire:wire-runtime (4.6.1)

com.squareup.wire:wire-runtime MAVEN version 4.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-grpc-client 4.6.1 - com.squareup.wire:wire-schema 4.6.1 Source cves:...

com.squareup.wire:wire-grpc-client (4.7.1), com.squareup.wire:wire-schema (4.7.1) +1 more potentially affected by CVE-2024-58103 via com.squareup.wire:wire-runtime (4.7.1)

com.squareup.wire:wire-runtime MAVEN version 4.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-grpc-client 4.7.1 - com.squareup.wire:wire-schema 4.7.1 -...

com.squareup.wire:wire-grpc-client (4.9.0), com.squareup.wire:wire-schema (4.9.0) +1 more potentially affected by CVE-2024-58103 via com.squareup.wire:wire-runtime (4.9.0)

com.squareup.wire:wire-runtime MAVEN version 4.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-grpc-client 4.9.0 - com.squareup.wire:wire-schema 4.9.0 -...

com.squareup.wire:wire-grpc-client (4.9.1), com.squareup.wire:wire-schema (4.9.1) +8 more potentially affected by CVE-2024-58103 via com.squareup.wire:wire-runtime (4.9.1)

com.squareup.wire:wire-runtime MAVEN version 4.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-grpc-client 4.9.1 - com.squareup.wire:wire-schema 4.9.1 -...

com.squareup.wire:wire-grpc-client (4.9.2), com.squareup.wire:wire-schema (4.9.2) +4 more potentially affected by CVE-2024-58103 via com.squareup.wire:wire-runtime (4.9.2)

com.squareup.wire:wire-runtime MAVEN version 4.9.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-grpc-client 4.9.2 - com.squareup.wire:wire-schema 4.9.2 -...

com.squareup.wire:wire-grpc-client (4.9.4), com.squareup.wire:wire-schema (4.9.4) +1 more potentially affected by CVE-2024-58103 via com.squareup.wire:wire-runtime (4.9.4)

com.squareup.wire:wire-runtime MAVEN version 4.9.4 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-grpc-client 4.9.4 - com.squareup.wire:wire-schema 4.9.4 -...

com.squareup.wire:wire-grpc-client (4.9.5), com.squareup.wire:wire-schema (4.9.5) +1 more potentially affected by CVE-2024-58103 via com.squareup.wire:wire-runtime (4.9.5)

com.squareup.wire:wire-runtime MAVEN version 4.9.5 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-grpc-client 4.9.5 - com.squareup.wire:wire-schema 4.9.5 -...

androidx.benchmark:benchmark-common (>=1.3.0-alpha02, <=1.3.4), androidx.benchmark:benchmark-macro (>=1.3.0-alpha02, <=1.3.4) +8 more potentially affected by CVE-2024-58103 via com.squareup.wire:wire-runtime (4.9.7)

com.squareup.wire:wire-runtime MAVEN version 4.9.7 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - androidx.benchmark:benchmark-common =1.3.0-alpha02, =1.3.0-alpha02, =2.5.9.final, =2.5.9.final,...

com.squareup.wire:wire-grpc-client (4.9.8), com.squareup.wire:wire-schema (4.9.8) +2 more potentially affected by CVE-2024-58103 via com.squareup.wire:wire-runtime (4.9.8)

com.squareup.wire:wire-runtime MAVEN version 4.9.8 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-grpc-client 4.9.8 - com.squareup.wire:wire-schema 4.9.8 -...

com.squareup.wire:wire-grpc-client (4.9.11), com.squareup.wire:wire-schema (4.9.11) +4 more potentially affected by CVE-2024-58103 via com.squareup.wire:wire-runtime (4.9.11)

com.squareup.wire:wire-runtime MAVEN version 4.9.11 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-grpc-client 4.9.11 - com.squareup.wire:wire-schema 4.9.11 -...

CVE-2025-27407

A flaw was found in graphql-ruby. In affected versions of graphq-ruby, loading a malicious schema definition in the GraphQL::Schema.fromintrospection or the GraphQL::Schema::Loader.load can cause remote code execution. Any system that loads a schema by JSON from an untrusted source is vulnerable,...

graphql allows remote code execution when loading a crafted GraphQL schema

Summary Loading a malicious schema definition in GraphQL::Schema.fromintrospection or GraphQL::Schema::Loader.load can result in remote code execution. Any system which loads a schema by JSON from an untrusted source is vulnerable, including those that use GraphQL::Client to load external schemas...

GHSA-Q92J-GRW3-H492 graphql allows remote code execution when loading a crafted GraphQL schema

Summary Loading a malicious schema definition in GraphQL::Schema.fromintrospection or GraphQL::Schema::Loader.load can result in remote code execution. Any system which loads a schema by JSON from an untrusted source is vulnerable, including those that use GraphQL::Client to load external schemas...

Arbitrary Code Injection

Overview graphql is a plain-Ruby implementation of GraphQL. Affected versions of this package are vulnerable to Arbitrary Code Injection via the GraphQL::Schema.fromintrospection or GraphQL::Schema::Loader.load processes. An attacker can execute arbitrary code by loading a crafted GraphQL schema...

DEBIAN-CVE-2025-27407

graphql-ruby is a Ruby implementation of GraphQL. Starting in version 1.11.5 and prior to versions 1.11.8, 1.12.25, 1.13.24, 2.0.32, 2.1.14, 2.2.17, and 2.3.21, loading a malicious schema definition in GraphQL::Schema.fromintrospection or GraphQL::Schema::Loader.load can result in remote code...

CVE-2025-27407

graphql-ruby is a Ruby implementation of GraphQL. Starting in version 1.11.5 and prior to versions 1.11.8, 1.12.25, 1.13.24, 2.0.32, 2.1.14, 2.2.17, and 2.3.21, loading a malicious schema definition in GraphQL::Schema.fromintrospection or GraphQL::Schema::Loader.load can result in remote code...

UBUNTU-CVE-2025-27407

graphql-ruby is a Ruby implementation of GraphQL. Starting in version 1.11.5 and prior to versions 1.11.8, 1.12.25, 1.13.24, 2.0.32, 2.1.14, 2.2.17, and 2.3.21, loading a malicious schema definition in GraphQL::Schema.fromintrospection or GraphQL::Schema::Loader.load can result in remote code...