Wrong type can be loaded from ID when `loads:` is an Object and not used elsewhere in the schema
Published: September 21, 2026
SECURITY IDENTIFIERS
- GHSA: GHSA-p3g2-4c7r-4fww
- Vendor Advisory: https://github.com/rmosolgo/graphql-ruby/security/advisories/GHSA-p3g2-4c7r-4fww
GEM
UNAFFECTED VERSIONS
< 2.1.2
PATCHED VERSIONS
>= 2.6.11
DESCRIPTION
When an argument uses loads: and references an Object type which is not used as a return type of any fields in the schema (or as a member of an Interface or Union type which is returned by the schema), GraphQL-Ruby didn't properly check that the application object loaded from the provided ID was resolved to the same type referenced by loads:.