CVE-2025-59845 Apollo Embedded Sandbox and Explorer vulnerable to CSRF via window.postMessage origin-validation bypass
Attackers can forge messages to execute arbitrary GraphQL queries or mutations on behalf of authenticated users via missing origin validation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-59845?
CVE-2025-59845 is a high-severity vulnerability in apollographql embeddable-explorer, published on 26 Sep 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Apollo Studio Embeddable Explorer & Embeddable Sandbox are website embeddable software solutions from Apollo GraphQL. Prior to Apollo Sandbox version 2.7.2 and Apollo Explorer version 3.7.3, a cross-site request forgery (CSRF) vulnerability was identified. The vulnerability arises from missing origin validation in the client-side code that handles window.postMessage events. A malicious website can send forged messages to the embedding page, causing the victim’s browser to execute arbitrary GraphQL queries or mutations against their GraphQL server while authenticated with the victim’s cookies. This issue has been patched in Apollo Sandbox version 2.7.2 and Apollo Explorer version 3.7.3.
Which versions are affected by CVE-2025-59845?
4 open source packages ship an affected version, including @apollo/explorer and @apollo/sandbox.
| Package | Affected | Fixed in |
|---|---|---|
@apollo/explorer npm | All versions | 3.7.3 |
@apollo/explorer npm | All versions | 3.7.3 |
@apollo/sandbox npm | All versions | 2.7.2 |
@apollo/sandbox npm | All versions | 2.7.2 |
How do I fix CVE-2025-59845?
Upgrade @apollo/explorer to 3.7.3 or later.
Is CVE-2025-59845 being exploited?
There is no known exploitation of CVE-2025-59845 in the wild and no public exploit code.
Sources
Also known as GHSA-w87v-7w53-wwxv.