CVE-2025-22151 json
Strawberry GraphQL has a type resolution vulnerability
published 2025-01-09 21 mo ago modified 2026-07-07 4 mo ago also EUVD-2025-0010 , GHSA-5xh2-23cc-5jc6 , PYSEC-2026-1946
- cvss
- 3.7
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 32%
- public exploits
- 0
- none known
Summary
Strawberry GraphQL is a library for creating GraphQL APIs. Starting in 0.182.0 and prior to version 0.257.0, a type confusion vulnerability exists in Strawberry GraphQL's relay integration that affects multiple ORM integrations (Django, SQLAlchemy, Pydantic). The vulnerability occurs when multiple GraphQL types are mapped to the same underlying model while using the relay node interface. When querying for a specific type using the global node field (e.g., FruitType:some-id), the resolver may incorrectly return an instance of a different type mapped to the same model (e.g., SpecialFruitType). This can lead to information disclosure if the alternate type exposes sensitive fields and potential privilege escalation if the alternate type contains data intended for restricted access. This vulnerability is fixed in 0.257.0.
Patch / fix
- pypi strawberry-graphql 0.257.0
- strawberry strawberry_graphql 0.257.0
- strawberryrocks strawberry 0.257.0
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 21 mo ago
Exploit prediction
0.39% chance of exploitation in the next 30 days, higher than 32% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 3.7 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N |
| GitHub | 3.1 | 3.7 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N |
| OSV | 3.1 | 3.7 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | strawberry-graphql | >=0.182.0, <0.257.0 |
0.257.0 |
Affected products
- strawberry-graphql strawberry
Classification
References
-
github.com
/strawberry-graphql/strawberry/commit/526eb82b70451c0e59d5a71ae9b7396f59974bd8
web
-
github.com
/strawberry-graphql/strawberry/security/advisories/GHSA-5xh2-23cc-5jc6
web
-
nvd.nist.gov
/vuln/detail/CVE-2025-22151
advisory
-
github.com
/strawberry-graphql/strawberry
package
-
pypi.org
/project/strawberry-graphql
package
-
github.com
/advisories/GHSA-5xh2-23cc-5jc6
advisory
Sources
- CVE List CVE-2025-22151
- GitHub Advisory GHSA-5xh2-23cc-5jc6
- NVD CVE-2025-22151
- OSV PYSEC-2026-1946
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.