| Version | Supported |
|---|---|
| >= 2.0.0 | ✅ |
| < 2.0.0 | ❌ |
If you have found a security issue with GraphQL-Ruby, please report it on GitHub: https://github.com/rmosolgo/graphql-ruby/security
Repository navigation
Security: rmosolgo/graphql-ruby
Security
SECURITY.md
-
Execution::Next reuses Relay scoped authorization for unrelated child fields, disclosing protected dataGHSA-965v-9v76-5hg2 published
Oct 14, 2026 by rmosolgoHigh -
Wrong type can be loaded from ID when `loads:` is an Object and not used elsewhere in the schemaGHSA-p3g2-4c7r-4fww published
Sep 21, 2026 by rmosolgoHigh -
Unsafe Marshal deserialization in the parser cache can lead to arbitrary Ruby code executionGHSA-rmxg-5p3r-j6hh published
Aug 17, 2026 by rmosolgoHigh -
Unauthenticated remote use-after-free in graphql-c_parserGHSA-52mm-32rv-3rpg published
Aug 3, 2026 by rmosolgoCritical -
Authorization Bypass in Execution::NextGHSA-j7xr-4g94-r9h3 published
Jul 21, 2026 by rmosolgoHigh -
Ruby lexer does not count comment tokens for the purposes of max_query_string_tokensGHSA-3h96-34p3-xm76 published
Apr 27, 2026 by rmosolgoModerate -
Remote code execution when loading a crafted GraphQL schemaGHSA-q92j-grw3-h492 published
Mar 12, 2025 by rmosolgoCritical
Learn more about advisories related to rmosolgo/graphql-ruby in the GitHub Advisory Database