Cross-Site Request Forgery in Apollo GraphQL's Embeddable Tools
CVE-2025-59845

8.2HIGH

Key Information:

Vendor

Apollographql

Status
Embeddable-explorer
Vendor
CVE Published:
26 September 2025

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2025-59845?

A significant vulnerability exists in the Apollo Studio Embeddable Explorer and Embeddable Sandbox, stemming from inadequate origin validation within their client-side code that processes window.postMessage events. This weakness allows a malicious website to forge messages to the embedding page, potentially enabling unauthorized execution of GraphQL queries or mutations on behalf of authenticated users. The issue, found in versions prior to Apollo Sandbox 2.7.2 and Apollo Explorer 3.7.3, compromises user security by exploiting their logged-in session to interact with GraphQL servers without consent. Updates have been released to address this serious concern.

Affected Version(s)

embeddable-explorer < 2.7.2 < 2.7.2

embeddable-explorer < 3.7.3 < 3.7.3

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

cve-2025-59845
Created by C3viche

References

https://github.com/apollographql/embeddable-explorer/secu...
x_refsource_CONFIRM

CVSS V3.1

Score:
8.2
Severity:
HIGH
Confidentiality:
Low
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.