Remote code execution via crafted GraphQL schema in graphql-ruby
A critical vulnerability in graphql-ruby allows remote code execution when loading a crafted GraphQL schema from untrusted sources via introspection queries. The issue affects multiple versions of the library and was disclosed on March 12, 2025.
What happened
Loading a malicious schema definition in GraphQL::Schema.from_introspection or GraphQL::Schema::Loader.load can result in remote code execution.
Any system which loads a schema by JSON from an untrusted source is vulnerable, including those that use GraphQL::Client to load external schemas via GraphQL introspection.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.