CVE-2026-33286

Description

### Summary An arbitrary method execution vulnerability has been found which affects Graphiti's JSONAPI write functionality. An attacker can craft a malicious JSONAPI payload with arbitrary relationship names to invoke any public method on the underlying model instance, class or its associations. ### Impact Any application exposing Graphiti write endpoints (create/update/delete) to untrusted users is affected. The `Graphiti::Util::ValidationResponse#all_valid?` method recursively calls `model.send(name)` using relationship names taken directly from user-supplied JSONAPI payloads, without validating them against the resource's configured sideloads. This allows an attacker to potentially run any public method on a given model instance, on the instance class or associated instances or classes, including destructive operations. ### Patches This is patched in Graphiti **v1.10.2**. Users should upgrade as soon as possible. ### Workarounds If upgrading to v1.10.2 is not immediately possible, consider one or more of the following mitigations: - **Restrict write access**: Ensure Graphiti write endpoints (create/update/delete) are not accessible to untrusted users. - **Authentication & authorisation**: Apply strong authentication and authorisation checks before any write operation is processed, for example use Rails strong parameters to ensure only valid parameters are processed.

Priority Score