[DRE-maint] Bug#1100442: ruby-graphql: CVE-2025-27407

[Salvatore Bonaccorso]

Source: ruby-graphql
Version: 2.2.5-3
Severity: grave
Tags: security upstream
Justification: user security hole
X-Debbugs-Cc: carnil at debian.org, Debian Security Team <team at security.debian.org>

Hi,

The following vulnerability was published for ruby-graphql.

CVE-2025-27407[0]:
| graphql-ruby is a Ruby implementation of GraphQL. Starting in
| version 1.11.5 and prior to versions 1.11.8, 1.12.25, 1.13.24,
| 2.0.32, 2.1.14, 2.2.17, and 2.3.21, loading a malicious schema
| definition in `GraphQL::Schema.from_introspection` (or
| `GraphQL::Schema::Loader.load`) can result in remote code execution.
| Any system which loads a schema by JSON from an untrusted source is
| vulnerable, including those that use GraphQL::Client to load
| external schemas via GraphQL introspection. Versions 1.11.8,
| 1.12.25, 1.13.24, 2.0.32, 2.1.14, 2.2.17, and 2.3.21 contain a patch
| for the issue.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2025-27407
    https://www.cve.org/CVERecord?id=CVE-2025-27407
[1] https://github.com/rmosolgo/graphql-ruby/security/advisories/GHSA-q92j-grw3-h492

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore