CVE-2026-33286

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-33286", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-18T18:55:47.426Z", "datePublished": "2026-03-23T23:52:30.381Z", "dateUpdated": "2026-03-24T13:35:27.686Z"}, "containers": {"cna": {"title": "Graphiti Affected by Arbitrary Method Execution via Unvalidated Relationship Names", "problemTypes": [{"descriptions": [{"cweId": "CWE-913", "lang": "en", "description": "CWE-913: Improper Control of Dynamically-Managed Code Resources", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/graphiti-api/graphiti/security/advisories/GHSA-3m5v-4xp5-gjg2", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/graphiti-api/graphiti/security/advisories/GHSA-3m5v-4xp5-gjg2"}, {"name": "https://github.com/graphiti-api/graphiti/commit/ddb5ad2b69330774bd1a47935ed89a9fe4396a54", "tags": ["x_refsource_MISC"], "url": "https://github.com/graphiti-api/graphiti/commit/ddb5ad2b69330774bd1a47935ed89a9fe4396a54"}, {"name": "https://github.com/graphiti-api/graphiti/releases/tag/v1.10.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/graphiti-api/graphiti/releases/tag/v1.10.2"}], "affected": [{"vendor": "graphiti-api", "product": "graphiti", "versions": [{"version": "< 1.10.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-23T23:52:30.381Z"}, "descriptions": [{"lang": "en", "value": "Graphiti is a framework that sits on top of models and exposes them via a JSON:API-compliant interface. Versions prior to 1.10.2 have an arbitrary method execution vulnerability that affects Graphiti's JSONAPI write functionality. An attacker can craft a malicious JSONAPI payload with arbitrary relationship names to invoke any public method on the underlying model instance, class or its associations. Any application exposing Graphiti write endpoints (create/update/delete) to untrusted users is affected. The `Graphiti::Util::ValidationResponse#all_valid?` method recursively calls `model.send(name)` using relationship names taken directly from user-supplied JSONAPI payloads, without validating them against the resource's configured sideloads. This allows an attacker to potentially run any public method on a given model instance, on the instance class or associated instances or classes, including destructive operations. This is patched in Graphiti v1.10.2. Users should upgrade as soon as possible. Some workarounds are available. Ensure Graphiti write endpoints (create/update) are not accessible to untrusted users and/or apply strong authentication and authorization checks before any write operation is processed, for example use Rails strong parameters to ensure only valid parameters are processed."}], "source": {"advisory": "GHSA-3m5v-4xp5-gjg2", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-24T13:35:19.770094Z", "id": "CVE-2026-33286", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-24T13:35:27.686Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-33286", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-24T13:35:19.770094Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-24T13:35:23.250Z"}}], "cna": {"title": "Graphiti Affected by Arbitrary Method Execution via Unvalidated Relationship Names", "source": {"advisory": "GHSA-3m5v-4xp5-gjg2", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "graphiti-api", "product": "graphiti", "versions": [{"status": "affected", "version": "< 1.10.2"}]}], "references": [{"url": "https://github.com/graphiti-api/graphiti/security/advisories/GHSA-3m5v-4xp5-gjg2", "name": "https://github.com/graphiti-api/graphiti/security/advisories/GHSA-3m5v-4xp5-gjg2", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/graphiti-api/graphiti/commit/ddb5ad2b69330774bd1a47935ed89a9fe4396a54", "name": "https://github.com/graphiti-api/graphiti/commit/ddb5ad2b69330774bd1a47935ed89a9fe4396a54", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/graphiti-api/graphiti/releases/tag/v1.10.2", "name": "https://github.com/graphiti-api/graphiti/releases/tag/v1.10.2", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Graphiti is a framework that sits on top of models and exposes them via a JSON:API-compliant interface. Versions prior to 1.10.2 have an arbitrary method execution vulnerability that affects Graphiti's JSONAPI write functionality. An attacker can craft a malicious JSONAPI payload with arbitrary relationship names to invoke any public method on the underlying model instance, class or its associations. Any application exposing Graphiti write endpoints (create/update/delete) to untrusted users is affected. The `Graphiti::Util::ValidationResponse#all_valid?` method recursively calls `model.send(name)` using relationship names taken directly from user-supplied JSONAPI payloads, without validating them against the resource's configured sideloads. This allows an attacker to potentially run any public method on a given model instance, on the instance class or associated instances or classes, including destructive operations. This is patched in Graphiti v1.10.2. Users should upgrade as soon as possible. Some workarounds are available. Ensure Graphiti write endpoints (create/update) are not accessible to untrusted users and/or apply strong authentication and authorization checks before any write operation is processed, for example use Rails strong parameters to ensure only valid parameters are processed."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-913", "description": "CWE-913: Improper Control of Dynamically-Managed Code Resources"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-23T23:52:30.381Z"}}}, "cveMetadata": {"cveId": "CVE-2026-33286", "state": "PUBLISHED", "dateUpdated": "2026-03-24T13:35:27.686Z", "dateReserved": "2026-03-18T18:55:47.426Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-23T23:52:30.381Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "graphiti", "vendor": "graphiti-api", "versions": [{"status": "affected", "version": "< 1.10.2"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:graphiti:graphiti:*:*:*:*:*:ruby:*:*", "matchCriteriaId": "2C0B7C94-5FBF-428C-B558-7A56DA34C7D2", "versionEndExcluding": "1.10.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Graphiti is a framework that sits on top of models and exposes them via a JSON:API-compliant interface. Versions prior to 1.10.2 have an arbitrary method execution vulnerability that affects Graphiti's JSONAPI write functionality. An attacker can craft a malicious JSONAPI payload with arbitrary relationship names to invoke any public method on the underlying model instance, class or its associations. Any application exposing Graphiti write endpoints (create/update/delete) to untrusted users is affected. The `Graphiti::Util::ValidationResponse#all_valid?` method recursively calls `model.send(name)` using relationship names taken directly from user-supplied JSONAPI payloads, without validating them against the resource's configured sideloads. This allows an attacker to potentially run any public method on a given model instance, on the instance class or associated instances or classes, including destructive operations. This is patched in Graphiti v1.10.2. Users should upgrade as soon as possible. Some workarounds are available. Ensure Graphiti write endpoints (create/update) are not accessible to untrusted users and/or apply strong authentication and authorization checks before any write operation is processed, for example use Rails strong parameters to ensure only valid parameters are processed."}, {"lang": "es", "value": "Graphiti es un framework que se asienta sobre modelos y los expone a trav\u00e9s de una interfaz compatible con JSON:API. Las versiones anteriores a la 1.10.2 tienen una vulnerabilidad de ejecuci\u00f3n arbitraria de m\u00e9todos que afecta la funcionalidad de escritura JSONAPI de Graphiti. Un atacante puede crear una carga \u00fatil JSONAPI maliciosa con nombres de relaci\u00f3n arbitrarios para invocar cualquier m\u00e9todo p\u00fablico en la instancia del modelo subyacente, la clase o sus asociaciones. Cualquier aplicaci\u00f3n que exponga puntos finales de escritura de Graphiti (crear/actualizar/eliminar) a usuarios no confiables se ve afectada. El m\u00e9todo 'Graphiti::Util::ValidationResponse#all_valid?' llama recursivamente a 'model.send(name)' utilizando nombres de relaci\u00f3n tomados directamente de las cargas \u00fatiles JSONAPI proporcionadas por el usuario, sin validarlos contra los sideloads configurados del recurso. Esto permite a un atacante ejecutar potencialmente cualquier m\u00e9todo p\u00fablico en una instancia de modelo dada, en la clase de la instancia o en instancias o clases asociadas, incluyendo operaciones destructivas. Esto est\u00e1 parcheado en Graphiti v1.10.2. Los usuarios deben actualizar lo antes posible. Algunas soluciones alternativas est\u00e1n disponibles. Aseg\u00farese de que los puntos finales de escritura de Graphiti (crear/actualizar) no sean accesibles para usuarios no confiables y/o aplique fuertes controles de autenticaci\u00f3n y autorizaci\u00f3n antes de que se procese cualquier operaci\u00f3n de escritura, por ejemplo, use los par\u00e1metros fuertes de Rails para asegurar que solo se procesen par\u00e1metros v\u00e1lidos."}], "id": "CVE-2026-33286", "lastModified": "2026-06-17T10:37:15.180", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-33286", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-24T13:35:19.770094Z", "version": "2.0.3"}}]}, "published": "2026-03-24T00:16:30.683", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/graphiti-api/graphiti/commit/ddb5ad2b69330774bd1a47935ed89a9fe4396a54"}, {"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/graphiti-api/graphiti/releases/tag/v1.10.2"}, {"source": "security-advisories@github.com", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://github.com/graphiti-api/graphiti/security/advisories/GHSA-3m5v-4xp5-gjg2"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-913"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.10.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "graphiti", "source": "cna", "vendor": "graphiti-api"}, "product": "graphiti", "vendor": "graphiti-api"}], "analysis": {"en": {"generated_at": "2026-03-25T19:40:46.001768+00:00", "value": {"mitigation_remediation": ["Immediate upgrade to Graphiti v1.10.2 or newer", "Restrict write endpoints (create/update/delete) so that only trusted users can invoke them", "Implement strong authentication and authorization checks before processing any write request", "Apply Rails strong parameters or equivalent input filtering to allow only explicitly permitted attributes", "Monitor application logs for unexpected method calls or anomalous activity following the patch"], "summary": {"action": "Immediate Patch", "impact": "Arbitrary method execution on data models via unauthenticated write endpoints"}, "threat_synthesis": {"affected_systems": "Entities affected are applications built with Graphiti core library graphiti before version 1.10.2. The vulnerability is present in any codebase using the Graphiti JSONAPI write endpoints exposed to untrusted users. The product is the Ruby gem graphiti; any Rails or Ruby application that incorporates Graphiti for RESTful interfaces is at risk if those endpoints are reachable from external input. The commit reference showing the altered code and the release tag v1.10.2 are the primary indicators of the affected release range.", "description_and_impact": "Graphiti is an API framework that exposes data models via JSON:API. Packages prior to version 1.10.2 contain code that evaluates relationship names from client payloads without validation. When a write operation (create, update, delete) is called, the library recursively invokes model.send(name) on the supplied relationship names. This behavior allows an attacker who can send a malicious JSON:API payload to trigger any public method defined on the model instance, the model class, or its associations. The result can be arbitrary code execution, data manipulation, or other destructive actions, depending on the methods exposed by the application. The weakness is consistent with CWE\u2011913, representing vulnerability that permits an attacker to invoke unintended methods via improper input handling.", "risk_and_exploitability": "The vulnerability scores 9.1 on CVSS, indicating critical severity. EPSS below 1% shows the probability of widespread active exploitation is low at present, and it is not listed in the CISA KEV catalog. Nevertheless, the attack vector is HTTPS or HTTP to the write API, which can be reached by any authenticated or unauthenticated user if the endpoint is not protected. Because the flaw permits arbitrary method calls, a successful exploit could lead to data tampering, privilege escalation or denial of service. The advisory recommends upgrading immediately and applying access controls before the write operation; otherwise the risk remains high for any exposed Graphiti write interfaces."}}}}, "created": "2026-03-24T10:29:42.579866+00:00", "updated": "2026-03-25T20:40:55.071519+00:00", "vendors": ["graphiti-api", "graphiti-api$PRODUCT$graphiti"]}