CVE-2025-27407 Remote code execution when loading a crafted GraphQL schema
Attackers can achieve remote code execution by loading a malicious GraphQL schema from an untrusted source using the graphql-ruby library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-27407?
CVE-2025-27407 is a critical code injection vulnerability in rmosolgo graphql-ruby, published on 12 Mar 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
graphql-ruby is a Ruby implementation of GraphQL. Starting in version 1.11.5 and prior to versions 1.11.8, 1.12.25, 1.13.24, 2.0.32, 2.1.14, 2.2.17, and 2.3.21, loading a malicious schema definition in `GraphQL::Schema.from_introspection` (or `GraphQL::Schema::Loader.load`) can result in remote code execution. Any system which loads a schema by JSON from an untrusted source is vulnerable, including those that use GraphQL::Client to load external schemas via GraphQL introspection. Versions 1.11.8, 1.12.25, 1.13.24, 2.0.32, 2.1.14, 2.2.17, and 2.3.21 contain a patch for the issue.
Weakness: CWE-94
Which versions are affected by CVE-2025-27407?
16 open source packages ship an affected version, including graphql.
| Package | Affected | Fixed in |
|---|---|---|
graphql RubyGems | From 1.11.5 | 1.11.11 |
graphql RubyGems | From 1.11.5 | 1.11.11 |
graphql RubyGems | From 1.12.0 | 1.12.25 |
graphql RubyGems | From 1.12.0 | 1.12.25 |
graphql RubyGems | From 1.13.0 | 1.13.24 |
graphql RubyGems | From 1.13.0 | 1.13.24 |
10 more packages
graphql RubyGems | From 2.0.0 | 2.0.32 |
graphql RubyGems | From 2.0.0 | 2.0.32 |
graphql RubyGems | From 2.1.0 | 2.1.15 |
graphql RubyGems | From 2.1.0 | 2.1.15 |
graphql RubyGems | From 2.2.0 | 2.2.17 |
graphql RubyGems | From 2.2.0 | 2.2.17 |
graphql RubyGems | From 2.3.0 | 2.3.21 |
graphql RubyGems | From 2.3.0 | 2.3.21 |
graphql RubyGems | From 2.4.0 | 2.4.13 |
graphql RubyGems | From 2.4.0 | 2.4.13 |
How do I fix CVE-2025-27407?
Upgrade graphql to a fixed version for your release line: 1.11.11, 1.12.25, 1.13.24 or 2.0.32.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2025-27407 being exploited?
There is no known exploitation of CVE-2025-27407 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as DEBIAN-CVE-2025-27407, DLA-4263-1, GHSA-q92j-grw3-h492, UBUNTU-CVE-2025-27407.