Vulnerability DatabaseCVE-2025-27407

CVE-2025-27407:
Ruby vulnerability analysis and mitigation

Overview

CVE-2025-27407 is a critical vulnerability in graphql-ruby, a Ruby implementation of GraphQL. The vulnerability affects versions starting from 1.11.5 and prior to versions 1.11.8, 1.12.25, 1.13.24, 2.0.32, 2.1.14, 2.2.17, and 2.3.21. The issue was discovered in March 2025 and allows remote code execution when loading malicious schema definitions through GraphQL::Schema.from_introspection or GraphQL::Schema::Loader.load functions (NVD, Security Online).

Technical details

The vulnerability has a CVSS v3.1 base score of 9.1 (Critical) with the vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H. The issue specifically affects systems that load schemas by JSON from untrusted sources, including applications that use GraphQL::Client to load external schemas via GraphQL introspection. The vulnerability is classified as CWE-94 (Improper Control of Generation of Code) (GitHub Advisory).

Impact

The vulnerability can lead to remote code execution, potentially allowing attackers to gain full control of affected servers. With over 136 million downloads of the library, the potential impact is significant. The vulnerability could result in data breaches, system disruption, and other malicious activities (Security Online).

Mitigation and workarounds

For users who cannot immediately update, the following mitigation steps are recommended: 1) Disable migration of groups and projects by direct transfer if enabled (it is disabled by default). 2) Update to one of the patched versions: 1.11.8, 1.12.25, 1.13.24, 2.0.32, 2.1.14, 2.2.17, or 2.3.21 (GitHub Advisory).

Community reactions

GitLab has responded to this vulnerability by implementing patches in their versions 17.9.2, 17.8.5, and 17.7.7. They strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately. GitLab.com has already been patched to address this vulnerability (GitLab Release).