Search for packages
| purl | pkg:gem/graphql@1.13.3 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-hjcr-1st5-v3dg
Aliases: CVE-2025-27407 GHSA-q92j-grw3-h492 |
graphql-ruby is a Ruby implementation of GraphQL. Starting in version 1.11.5 and prior to versions 1.11.8, 1.12.25, 1.13.24, 2.0.32, 2.1.14, 2.2.17, and 2.3.21, loading a malicious schema definition in `GraphQL::Schema.from_introspection` (or `GraphQL::Schema::Loader.load`) can result in remote code execution. Any system which loads a schema by JSON from an untrusted source is vulnerable, including those that use GraphQL::Client to load external schemas via GraphQL introspection. Versions 1.11.8, 1.12.25, 1.13.24, 2.0.32, 2.1.14, 2.2.17, and 2.3.21 contain a patch for the issue. |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 1 other vulnerability. Affected by 1 other vulnerability. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||
| Date | Actor | Action | Vulnerability | Source | VulnerableCode Version |
|---|---|---|---|---|---|
| 2026-06-13T09:26:09.943994+00:00 | Ruby Importer | Affected by | VCID-hjcr-1st5-v3dg | https://github.com/rubysec/ruby-advisory-db/blob/master/gems/graphql/CVE-2025-27407.yml | 38.6.0 |
| 2026-06-12T19:54:48.446608+00:00 | GitLab Importer | Affected by | VCID-hjcr-1st5-v3dg | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/gem/graphql/CVE-2025-27407.yml | 38.6.0 |