CVE-2025-27407: (third party gem graphql)

Published Mar 12, 2025
·
Updated

Summary

Loading a malicious schema definition in GraphQL::Schema.fromintrospection (or GraphQL::Schema::Loader.load) can result in remote code execution. Any system which loads a schema by JSON from an untrusted source is vulnerable, including those that use GraphQL::Client to load external schemas via GraphQL introspection.

Other sources

GitLab has remediated a privately disclosed security issue (CVE-2025-27407) identified in the Ruby graphql library, which affects and has been remediated in GitLab.com, and in GitLab CE/EE versions 17.7.7, 17.8.5, and 17.9.2.

— GitLab

graphql-ruby is a Ruby implementation of GraphQL. Starting in version 1.11.5 and prior to versions 1.11.8, 1.12.25, 1.13.24, 2.0.32, 2.1.14, 2.2.17, and 2.3.21, loading a malicious schema definition in GraphQL::Schema.fromintrospection (or GraphQL::Schema::Loader.load) can result in remote code execution. Any system which loads a schema by JSON from an untrusted source is vulnerable, including those that use GraphQL::Client to load external schemas via GraphQL introspection. Versions 1.11.8, 1.12.25, 1.13.24, 2.0.32, 2.1.14, 2.2.17, and 2.3.21 contain a patch for the issue.

— NVD

Affected Software

9 affected componentsFixes available
graphql-ruby graphql-ruby>1.11.5<=1.11.8, >1.11.8<=1.12.25, >1.12.25<=1.13.24, >1.13.24<=2.0.32, >2.0.32<=2.1.14, >2.1.14<=2.2.17, >2.2.17<=2.3.21
rubygems/graphql>=2.2.0<2.2.17
2.2.17
rubygems/graphql>=1.11.5<1.11.11
1.11.11
rubygems/graphql>=2.1.0<2.1.15
2.1.15
rubygems/graphql>=1.12.0<1.12.25
1.12.25
rubygems/graphql>=1.13.0<1.13.24
1.13.24
rubygems/graphql>=2.0.0<2.0.32
2.0.32
rubygems/graphql>=2.3.0<2.3.21
2.3.21
rubygems/graphql>=2.4.0<2.4.13
2.4.13

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade rubygems/graphql to a version that resolves this vulnerability.

    Fixed in 2.2.17
  2. Upgrade

    Upgrade rubygems/graphql to a version that resolves this vulnerability.

    Fixed in 1.11.11
  3. Upgrade

    Upgrade rubygems/graphql to a version that resolves this vulnerability.

    Fixed in 2.1.15
  4. Upgrade

    Upgrade rubygems/graphql to a version that resolves this vulnerability.

    Fixed in 1.12.25
  5. Upgrade

    Upgrade rubygems/graphql to a version that resolves this vulnerability.

    Fixed in 1.13.24
  6. Upgrade

    Upgrade rubygems/graphql to a version that resolves this vulnerability.

    Fixed in 2.0.32
  7. Upgrade

    Upgrade rubygems/graphql to a version that resolves this vulnerability.

    Fixed in 2.3.21
  8. Upgrade

    Upgrade rubygems/graphql to a version that resolves this vulnerability.

    Fixed in 2.4.13
  9. Upgrade

    Upgrade graphql-ruby to a version that resolves this vulnerability.

    Fixed in 1.11.8
  10. Upgrade

    Upgrade graphql-ruby to a version that resolves this vulnerability.

    Fixed in 1.12.25
  11. Upgrade

    Upgrade graphql-ruby to a version that resolves this vulnerability.

    Fixed in 1.13.24
  12. Upgrade

    Upgrade graphql-ruby to a version that resolves this vulnerability.

    Fixed in 2.0.32
  13. Upgrade

    Upgrade graphql-ruby to a version that resolves this vulnerability.

    Fixed in 2.1.14
  14. Upgrade

    Upgrade graphql-ruby to a version that resolves this vulnerability.

    Fixed in 2.2.17
  15. Upgrade

    Upgrade graphql-ruby to a version that resolves this vulnerability.

    Fixed in 2.3.21
  16. Compensating control

    Avoid loading GraphQL schema definitions from untrusted sources via GraphQL::Schema.from_introspection (or GraphQL::Schema::Loader.load / GraphQL::Client introspection), since loading a malicious schema definition can result in remote code execution.

Event History

Mar 12, 2025
CVE Published
via MITRE·06:15 PM
Data Sourced
via MITRE·06:15 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·07:15 PM
DescriptionSeverityWeakness
Advisory Published
via GitHub·07:28 PM
Data Sourced
via Red Hat·09:42 PM
DescriptionSeverityAffected Software
Mar 13, 2025
News Published
via BleepingComputer·04:13 PM
News Published
via BleepingComputer·04:14 PM
Apr 21, 2026
Data Sourced
via GitLab·10:58 PM
Description

Peer vulnerabilities

Found alongside the following vulnerabilities.

Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2025-27407?

CVE-2025-27407 has been classified with a severity level indicating potential impact due to the loading of a malicious schema.

2

How do I fix CVE-2025-27407?

To fix CVE-2025-27407, upgrade to versions 1.11.8, 1.12.25, 1.13.24, 2.0.32, 2.1.14, 2.2.17, or 2.3.21 of graphql-ruby.

3

Which versions of graphql-ruby are affected by CVE-2025-27407?

The affected versions of graphql-ruby range from 1.11.5 to 1.11.8, from 1.12.0 to 1.12.25, and several other specific versions until 2.3.21.

4

What kind of vulnerability is CVE-2025-27407?

CVE-2025-27407 is a vulnerability related to the unsafe loading of malicious schema definitions in the graphql-ruby implementation.

5

Is there a specific method that is vulnerable in CVE-2025-27407?

Yes, the methods `GraphQL::Schema.from_introspection` and `GraphQL::Schema::Loader.load` are specifically vulnerable in CVE-2025-27407.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203