com.squareup.retrofit2:converter-wire (2.0.0-beta3), com.squareup.wire:wire-compiler (2.0.0) +6 more potentially affected by CVE-2024-58103 via com.squareup.wire:wire-runtime (2.0.0)

com.squareup.wire:wire-runtime MAVEN version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.retrofit2:converter-wire 2.0.0-beta3 - com.squareup.wire:wire-compiler 2.0.0 -...

com.squareup.wire:wire-compiler (2.0.0-beta8), com.squareup.wire:wire-gson-support (2.0.0-beta8) +4 more potentially affected by CVE-2024-58103 via com.squareup.wire:wire-runtime (2.0.0-beta8)

com.squareup.wire:wire-runtime MAVEN version 2.0.0-beta8 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-compiler 2.0.0-beta8 - com.squareup.wire:wire-gson-support 2.0.0-beta8...

com.squareup.wire:wire-compiler (2.0.0-beta6), com.squareup.wire:wire-gson-support (2.0.0-beta6) +3 more potentially affected by CVE-2024-58103 via com.squareup.wire:wire-runtime (2.0.0-beta6)

com.squareup.wire:wire-runtime MAVEN version 2.0.0-beta6 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-compiler 2.0.0-beta6 - com.squareup.wire:wire-gson-support 2.0.0-beta6...

com.squareup.wire:wire-grpc-client (4.9.5), com.squareup.wire:wire-schema (4.9.5) +1 more potentially affected by CVE-2024-58103 via com.squareup.wire:wire-runtime (4.9.5)

com.squareup.wire:wire-runtime MAVEN version 4.9.5 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-grpc-client 4.9.5 - com.squareup.wire:wire-schema 4.9.5 -...

com.squareup.wire:wire-grpc-client (4.9.0), com.squareup.wire:wire-schema (4.9.0) +1 more potentially affected by CVE-2024-58103 via com.squareup.wire:wire-runtime (4.9.0)

com.squareup.wire:wire-runtime MAVEN version 4.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-grpc-client 4.9.0 - com.squareup.wire:wire-schema 4.9.0 -...

com.squareup.wire:wire-grpc-client (4.0.0-alpha.19), com.squareup.wire:wire-schema (4.0.0-alpha.19) potentially affected by CVE-2024-58103 via com.squareup.wire:wire-runtime (4.0.0-alpha.19)

com.squareup.wire:wire-runtime MAVEN version 4.0.0-alpha.19 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-grpc-client 4.0.0-alpha.19 - com.squareup.wire:wire-schema...

com.squareup.wire:wire-grpc-client (4.0.0-alpha.16), com.squareup.wire:wire-schema (4.0.0-alpha.16) potentially affected by CVE-2024-58103 via com.squareup.wire:wire-runtime (4.0.0-alpha.16)

com.squareup.wire:wire-runtime MAVEN version 4.0.0-alpha.16 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-grpc-client 4.0.0-alpha.16 - com.squareup.wire:wire-schema...

com.squareup.wire:wire-compiler (2.0.0-beta1), com.squareup.wire:wire-gson-support (2.0.0-beta1) +2 more potentially affected by CVE-2024-58103 via com.squareup.wire:wire-runtime (2.0.0-beta1)

com.squareup.wire:wire-runtime MAVEN version 2.0.0-beta1 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-compiler 2.0.0-beta1 - com.squareup.wire:wire-gson-support 2.0.0-beta1...

com.squareup.wire:wire-compiler (2.0.0-beta2), com.squareup.wire:wire-gson-support (2.0.0-beta2) +2 more potentially affected by CVE-2024-58103 via com.squareup.wire:wire-runtime (2.0.0-beta2)

com.squareup.wire:wire-runtime MAVEN version 2.0.0-beta2 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-compiler 2.0.0-beta2 - com.squareup.wire:wire-gson-support 2.0.0-beta2...

com.squareup.wire:wire-grpc-client (4.9.11), com.squareup.wire:wire-schema (4.9.11) +4 more potentially affected by CVE-2024-58103 via com.squareup.wire:wire-runtime (4.9.11)

com.squareup.wire:wire-runtime MAVEN version 4.9.11 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-grpc-client 4.9.11 - com.squareup.wire:wire-schema 4.9.11 -...

com.squareup.wire:wire-grpc-client (4.5.6), com.squareup.wire:wire-schema (4.5.6) potentially affected by CVE-2024-58103 via com.squareup.wire:wire-runtime (4.5.6)

com.squareup.wire:wire-runtime MAVEN version 4.5.6 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-grpc-client 4.5.6 - com.squareup.wire:wire-schema 4.5.6 Source cves:...

com.squareup.wire:wire-grpc-client (4.4.3), com.squareup.wire:wire-schema (4.4.3) +2 more potentially affected by CVE-2024-58103 via com.squareup.wire:wire-runtime (4.4.3)

com.squareup.wire:wire-runtime MAVEN version 4.4.3 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-grpc-client 4.4.3 - com.squareup.wire:wire-schema 4.4.3 - io.dyte:core...

com.squareup.wire:wire-grpc-client (4.6.0), com.squareup.wire:wire-schema (4.6.0) potentially affected by CVE-2024-58103 via com.squareup.wire:wire-runtime (4.6.0)

com.squareup.wire:wire-runtime MAVEN version 4.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-grpc-client 4.6.0 - com.squareup.wire:wire-schema 4.6.0 Source cves:...

com.squareup.wire:wire-grpc-client (4.0.0-alpha.10), com.squareup.wire:wire-schema (4.0.0-alpha.10) potentially affected by CVE-2024-58103 via com.squareup.wire:wire-runtime (4.0.0-alpha.10)

com.squareup.wire:wire-runtime MAVEN version 4.0.0-alpha.10 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-grpc-client 4.0.0-alpha.10 - com.squareup.wire:wire-schema...

CVE-2025-27407

A flaw was found in graphql-ruby. In affected versions of graphq-ruby, loading a malicious schema definition in the GraphQL::Schema.fromintrospection or the GraphQL::Schema::Loader.load can cause remote code execution. Any system that loads a schema by JSON from an untrusted source is vulnerable,...

GHSA-Q92J-GRW3-H492 graphql allows remote code execution when loading a crafted GraphQL schema

Summary Loading a malicious schema definition in GraphQL::Schema.fromintrospection or GraphQL::Schema::Loader.load can result in remote code execution. Any system which loads a schema by JSON from an untrusted source is vulnerable, including those that use GraphQL::Client to load external schemas...

graphql allows remote code execution when loading a crafted GraphQL schema

Summary Loading a malicious schema definition in GraphQL::Schema.fromintrospection or GraphQL::Schema::Loader.load can result in remote code execution. Any system which loads a schema by JSON from an untrusted source is vulnerable, including those that use GraphQL::Client to load external schemas...

Arbitrary Code Injection

Overview graphql is a plain-Ruby implementation of GraphQL. Affected versions of this package are vulnerable to Arbitrary Code Injection via the GraphQL::Schema.fromintrospection or GraphQL::Schema::Loader.load processes. An attacker can execute arbitrary code by loading a crafted GraphQL schema...

CVE-2025-27407

graphql-ruby is a Ruby implementation of GraphQL. Starting in version 1.11.5 and prior to versions 1.11.8, 1.12.25, 1.13.24, 2.0.32, 2.1.14, 2.2.17, and 2.3.21, loading a malicious schema definition in GraphQL::Schema.fromintrospection or GraphQL::Schema::Loader.load can result in remote code...

DEBIAN-CVE-2025-27407

graphql-ruby is a Ruby implementation of GraphQL. Starting in version 1.11.5 and prior to versions 1.11.8, 1.12.25, 1.13.24, 2.0.32, 2.1.14, 2.2.17, and 2.3.21, loading a malicious schema definition in GraphQL::Schema.fromintrospection or GraphQL::Schema::Loader.load can result in remote code...