{"id":"CVE-2026-33286","aliases":["GHSA-3m5v-4xp5-gjg2"],"url":"https://o3.security/vulnerability/CVE-2026-33286","summary":"Graphiti Affected by Arbitrary Method Execution via Unvalidated Relationship Names","details":"### Summary\n\nAn arbitrary method execution vulnerability has been found which affects Graphiti's JSONAPI write functionality. An attacker can craft a malicious JSONAPI payload with arbitrary relationship names to invoke any public method on the underlying model instance, class or its associations.\n\n### Impact\n\nAny application exposing Graphiti write endpoints (create/update/delete) to untrusted users is affected. \n\nThe `Graphiti::Util::ValidationResponse#all_valid?` method recursively calls `model.send(name)` using relationship names taken directly from user-supplied JSONAPI payloads, without validating them against the resource's configured sideloads. This allows an attacker to potentially run any public method on a given model instance, on the instance class or associated instances or classes, including destructive operations.\n\n### Patches\n\nThis is patched in Graphiti **v1.10.2**. Users should upgrade as soon as possible.\n\n### Workarounds\n\nIf upgrading to v1.10.2 is not immediately possible, consider one or more of the following mitigations:\n\n- **Restrict write access**: Ensure Graphiti write endpoints (create/update/delete) are not accessible to untrusted users.\n- **Authentication & authorisation**: Apply strong authentication and authorisation checks before any write operation is processed, for example use Rails strong parameters to ensure only valid parameters are processed.","published":"2026-03-23T23:52:30.381Z","modified":"2026-10-28T02:30:47.028900072Z","cvss":{"score":9.1,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"RubyGems","name":"graphiti","fixedVersion":"1.10.2"}],"fix":{"url":"https://github.com/graphiti-api/graphiti/commit/ddb5ad2b69330774bd1a47935ed89a9fe4396a54","label":"graphiti-api/graphiti@ddb5ad2"},"references":[{"type":"WEB","url":"https://github.com/graphiti-api/graphiti/releases/tag/v1.10.2"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33286.json"},{"type":"ADVISORY","url":"https://github.com/graphiti-api/graphiti/security/advisories/GHSA-3m5v-4xp5-gjg2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33286"},{"type":"FIX","url":"https://github.com/graphiti-api/graphiti/commit/ddb5ad2b69330774bd1a47935ed89a9fe4396a54"},{"type":"PACKAGE","url":"https://github.com/graphiti-api/graphiti"},{"type":"WEB","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/graphiti/CVE-2026-33286.yml"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:30:47.028900072Z"}}