From 4ee6413c98f1314a8a8c0087a8c1ca5b18c50291 Mon Sep 17 00:00:00 2001 From: Al Snow <43523+jasnow@users.noreply.github.com> Date: Sun, 1 Nov 2026 10:49:00 -0500 Subject: [PATCH 1/4] Four new graphql advisories --- gems/graphql/GHSA-4rw8-495r-pf6j.yml | 23 +++++++++++++++++++++ gems/graphql/GHSA-965v-9v76-5hg2.yml | 30 ++++++++++++++++++++++++++++ gems/graphql/GHSA-p3g2-4c7r-4fww.yml | 28 ++++++++++++++++++++++++++ gems/graphql/GHSA-q3cc-p5hm-55wj.yml | 26 ++++++++++++++++++++++++ 4 files changed, 107 insertions(+) create mode 100644 gems/graphql/GHSA-4rw8-495r-pf6j.yml create mode 100644 gems/graphql/GHSA-965v-9v76-5hg2.yml create mode 100644 gems/graphql/GHSA-p3g2-4c7r-4fww.yml create mode 100644 gems/graphql/GHSA-q3cc-p5hm-55wj.yml diff --git a/gems/graphql/GHSA-4rw8-495r-pf6j.yml b/gems/graphql/GHSA-4rw8-495r-pf6j.yml new file mode 100644 index 0000000000..fcea1f3069 --- /dev/null +++ b/gems/graphql/GHSA-4rw8-495r-pf6j.yml @@ -0,0 +1,23 @@ +--- +gem: graphql +ghsa: 4rw8-495r-pf6j +url: https://github.com/rmosolgo/graphql-ruby/security/advisories/GHSA-4rw8-495r-pf6j +title: Execution::Next renders objects whose authorized? check failed +date: 2026-10-29 +description: | + In some cases, GraphQL::Execution::Next rendered results for objects + whose .authorized? hooks indicated that the object was unauthorized. +cvss_v3: 7.5 +unaffected_versions: + - "< 2.5.20" +patched_versions: + - ">= 2.6.14" +related: + url: + - https://rubygems.org/gems/graphql/versions/2.6.14 + - https://github.com/rmosolgo/graphql-ruby/blob/master/CHANGELOG.md#2614-29-oct-2026 + - https://github.com/rmosolgo/graphql-ruby/security/advisories/GHSA-4rw8-495r-pf6j +notes: | + - No CVE from GHSA URL. + - cvss_V3 from GHSA URL + - NOTE: gem name is "graphql" and repo name is "graphql-ruby". diff --git a/gems/graphql/GHSA-965v-9v76-5hg2.yml b/gems/graphql/GHSA-965v-9v76-5hg2.yml new file mode 100644 index 0000000000..f72ee441fc --- /dev/null +++ b/gems/graphql/GHSA-965v-9v76-5hg2.yml @@ -0,0 +1,30 @@ +--- +gem: graphql +ghsa: 965v-9v76-5hg2 +url: https://github.com/rmosolgo/graphql-ruby/security/advisories/GHSA-965v-9v76-5hg2 +title: Execution::Next reuses Relay scoped authorization for + unrelated child fields, disclosing protected data +date: 2026-10-14 +description: | + Starting in GraphQL-Ruby 2.5.21, when using Execution::Next, connection + fields whose type implemented def self.scoped(...) and used + reauthorize_scoped_objects(false) would wrongly skip authorization + on extra fields attached to the connections *Edge type. + + Schemas that don't use Execution::Next are not affected. Connections + that don't use def self.scoped and reauthorize_scoped_objects(false) + are not affected. Edge types that don't have extra, application-specific + fields are not affected. +unaffected_versions: + - "< 2.5.21" +patched_versions: + - ">= 2.6.12" +related: + url: + - https://rubygems.org/gems/graphql/versions/2.6.12 + - https://github.com/rmosolgo/graphql-ruby/blob/master/CHANGELOG.md#2612-14-oct-2026 + - https://github.com/rmosolgo/graphql-ruby/security/advisories/GHSA-965v-9v76-5hg2 +notes: | + - No CVE from GHSA URL. + - "High" Severity in GHSA URL + - NOTE: gem name is "graphql" and repo name is "graphql-ruby". diff --git a/gems/graphql/GHSA-p3g2-4c7r-4fww.yml b/gems/graphql/GHSA-p3g2-4c7r-4fww.yml new file mode 100644 index 0000000000..86c8c22e58 --- /dev/null +++ b/gems/graphql/GHSA-p3g2-4c7r-4fww.yml @@ -0,0 +1,28 @@ +--- +gem: graphql +ghsa: p3g2-4c7r-4fww +url: https://github.com/rmosolgo/graphql-ruby/security/advisories/GHSA-p3g2-4c7r-4fww +title: Wrong type can be loaded from ID when `loads:` is an Object + and not used elsewhere in the schema +date: 2026-09-21 +description: | + When an argument uses loads: and references an Object type which + is not used as a return type of any fields in the schema (or as a + member of an Interface or Union type which is returned by the schema), + GraphQL-Ruby didn't properly check that the application object + loaded from the provided ID was resolved to the same type referenced + by loads:. +unaffected_versions: + - "< 2.1.2" +patched_versions: + - ">= 2.6.11" +related: + url: + - https://rubygems.org/gems/graphql/versions/2.6.11 + - https://github.com/rmosolgo/graphql-ruby/blob/master/CHANGELOG.md#2611-21-sep-2026 + - https://github.com/rmosolgo/graphql-ruby/pull/5745 + - https://github.com/rmosolgo/graphql-ruby/security/advisories/GHSA-p3g2-4c7r-4fww +notes: | + - No CVE from GHSA URL. + - "High" Severity in GHSA URL + - NOTE: gem name is "graphql" and repo name is "graphql-ruby". diff --git a/gems/graphql/GHSA-q3cc-p5hm-55wj.yml b/gems/graphql/GHSA-q3cc-p5hm-55wj.yml new file mode 100644 index 0000000000..dcbb2af2b5 --- /dev/null +++ b/gems/graphql/GHSA-q3cc-p5hm-55wj.yml @@ -0,0 +1,26 @@ +--- +gem: graphql +ghsa: q3cc-p5hm-55wj +url: https://github.com/rmosolgo/graphql-ruby/security/advisories/GHSA-q3cc-p5hm-55wj +title: Interpreter runtime renders results from objects whose + `.authorized?` checks had failed +date: 2026-10-29 +description: | + The legacy interpreter (Execution::Interpreter) renders the original, + unauthorized object when authorized? raises GraphQL::UnauthorizedError + and Schema.unauthorized_object returns a replacement. + Returningfalse` correctly renders the replacement. +cvss_v3: 6.5 +unaffected_versions: + - "< 1.10.0" +patched_versions: + - ">= 2.6.14" +related: + url: + - https://rubygems.org/gems/graphql/versions/2.6.14 + - https://github.com/rmosolgo/graphql-ruby/blob/master/CHANGELOG.md#2614-29-oct-2026 + - https://github.com/rmosolgo/graphql-ruby/security/advisories/GHSA-q3cc-p5hm-55wj +notes: | + - No CVE from GHSA URL. + - cvss_V3 from GHSA URL + - NOTE: gem name is "graphql" and repo name is "graphql-ruby". From 42b2190903c8dc2b9adf1d9c88fab3e19c32f599 Mon Sep 17 00:00:00 2001 From: Al Snow <43523+jasnow@users.noreply.github.com> Date: Sun, 1 Nov 2026 11:52:16 -0500 Subject: [PATCH 2/4] Update gems/graphql/GHSA-q3cc-p5hm-55wj.yml Co-authored-by: Mike Dalessio --- gems/graphql/GHSA-q3cc-p5hm-55wj.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/gems/graphql/GHSA-q3cc-p5hm-55wj.yml b/gems/graphql/GHSA-q3cc-p5hm-55wj.yml index dcbb2af2b5..248803dec0 100644 --- a/gems/graphql/GHSA-q3cc-p5hm-55wj.yml +++ b/gems/graphql/GHSA-q3cc-p5hm-55wj.yml @@ -9,7 +9,7 @@ description: | The legacy interpreter (Execution::Interpreter) renders the original, unauthorized object when authorized? raises GraphQL::UnauthorizedError and Schema.unauthorized_object returns a replacement. - Returningfalse` correctly renders the replacement. + Returning false correctly renders the replacement. cvss_v3: 6.5 unaffected_versions: - "< 1.10.0" From fad0c09c6fbfcc3a2a3d6eeafe1e5b416f3864fa Mon Sep 17 00:00:00 2001 From: Al Snow <43523+jasnow@users.noreply.github.com> Date: Sun, 1 Nov 2026 11:52:37 -0500 Subject: [PATCH 3/4] Update gems/graphql/GHSA-q3cc-p5hm-55wj.yml Co-authored-by: Mike Dalessio --- gems/graphql/GHSA-q3cc-p5hm-55wj.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/gems/graphql/GHSA-q3cc-p5hm-55wj.yml b/gems/graphql/GHSA-q3cc-p5hm-55wj.yml index 248803dec0..699ce52fb4 100644 --- a/gems/graphql/GHSA-q3cc-p5hm-55wj.yml +++ b/gems/graphql/GHSA-q3cc-p5hm-55wj.yml @@ -21,6 +21,6 @@ related: - https://github.com/rmosolgo/graphql-ruby/blob/master/CHANGELOG.md#2614-29-oct-2026 - https://github.com/rmosolgo/graphql-ruby/security/advisories/GHSA-q3cc-p5hm-55wj notes: | - - No CVE from GHSA URL. + - No CVE from GHSA URL. - cvss_V3 from GHSA URL - NOTE: gem name is "graphql" and repo name is "graphql-ruby". From 68347e07a9bbb6ee0dabe3ac9a1702ed297337d6 Mon Sep 17 00:00:00 2001 From: Al Snow <43523+jasnow@users.noreply.github.com> Date: Sun, 1 Nov 2026 11:52:50 -0500 Subject: [PATCH 4/4] Update gems/graphql/GHSA-4rw8-495r-pf6j.yml Co-authored-by: Mike Dalessio --- gems/graphql/GHSA-4rw8-495r-pf6j.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/gems/graphql/GHSA-4rw8-495r-pf6j.yml b/gems/graphql/GHSA-4rw8-495r-pf6j.yml index fcea1f3069..4407b212bd 100644 --- a/gems/graphql/GHSA-4rw8-495r-pf6j.yml +++ b/gems/graphql/GHSA-4rw8-495r-pf6j.yml @@ -18,6 +18,6 @@ related: - https://github.com/rmosolgo/graphql-ruby/blob/master/CHANGELOG.md#2614-29-oct-2026 - https://github.com/rmosolgo/graphql-ruby/security/advisories/GHSA-4rw8-495r-pf6j notes: | - - No CVE from GHSA URL. + - No CVE from GHSA URL. - cvss_V3 from GHSA URL - NOTE: gem name is "graphql" and repo name is "graphql-ruby".