Skip to content
OpenAdvisories

Package · RubyGems

graphql

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • Medium 5.3
    GHSA-3h96-34p3-xm76

    GraphQL-Ruby's Ruby lexer does not count comment tokens for the purposes of max_query_string_tokens

    GraphQL-Ruby's `max_query_string_tokens` configuration didn't count comment tokens against the limit, allowing strings to be processed even after the configured maximum had actually been reached. In patched versions, the Ruby lexer does count these tokens. Gr…

    graphql RubyGems
  • Critical 9.1
    CVE-2025-27407 Public exploit

    Remote code execution when loading a crafted GraphQL schema

    graphql-ruby is a Ruby implementation of GraphQL. Starting in version 1.11.5 and prior to versions 1.11.8, 1.12.25, 1.13.24, 2.0.32, 2.1.14, 2.2.17, and 2.3.21, loading a malicious schema definition in `GraphQL::Schema.from_introspection` (or `GraphQL::Schema…

    rmosolgo graphql-ruby graphql ruby-graphql Debian Ubuntu RubyGems