There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - graphql-ruby is a Ruby implementation of GraphQL. Starting in version 1.11.5 and prior to versions 1.11.8,
    1.12.25, 1.13.24, 2.0.32, 2.1.14, 2.2.17, and 2.3.21, loading a malicious schema definition in
    `GraphQL::Schema.from_introspection` (or `GraphQL::Schema::Loader.load`) can result in remote code
    execution. Any system which loads a schema by JSON from an untrusted source is vulnerable, including those
    that use GraphQL::Client to load external schemas via GraphQL introspection. Versions 1.11.8, 1.12.25,
    1.13.24, 2.0.32, 2.1.14, 2.2.17, and 2.3.21 contain a patch for the issue. (CVE-2025-27407)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the a435609c-ffd5-11ef-b4e4-2cf05da270f3 advisory.

    Gitlab reports:
    CVE-2025-25291 and CVE-2025-25292 (third party gem ruby-saml)     CVE-2025-27407 (third party gem graphql)     Denial of Service Due to Inefficient Processing of Untrusted Input     Credentials disclosed when repository mirroring fails     Denial of Service Vulnerability in GitLab Approval Rules due to Unbounded Field     Internal Notes in Merge Requests Are Emailed to Non-Members Upon Review Submission     Maintainer can inject shell code in Google integrations     Guest with custom Admin group member permissions can approve the users invitation despite user caps

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:4576 advisory.

    Red Hat Satellite is a system management solution that allows organizations to     configure and maintain their systems without the necessity to provide public     Internet access to their servers or other client systems. It performs     provisioning and configuration management of predefined standard operating     environments.

    Security Fix(es):
    * python-django: Potential denial-of-service vulnerability in IPv6 validation (CVE-2024-56374)
    * python-jinja2: Sandbox breakout through indirect reference to format method (CVE-2024-56326)
    * rubygem-rack: Local File Inclusion in Rack::Static (CVE-2025-27610)
    * rubygem-graphql: Remote code execution when loading a crafted GraphQL schema (CVE-2025-27407)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has a package installed that is affected by a vulnerability as referenced in the dla-4263 advisory.

    - -----------------------------------------------------------------------     Debian LTS Advisory DLA-4263-1              debian-lts@lists.debian.org     https://www.debian.org/lts/security/                      Utkarsh Gupta     August 04, 2025                             https://wiki.debian.org/LTS
    - -----------------------------------------------------------------------

    Package        : ruby-graphql     Version        : 1.11.12-0+deb11u1     CVE ID         : CVE-2025-27407     Debian Bug     : 1100442

    ruby-graphql is GraphQL language and runtime for Ruby. It was     discovered that loading a malicious schema definition in     `GraphQL::Schema.from_introspection` (or     `GraphQL::Schema::Loader.load`) can result in remote code execution.
    Any system which loads a schema by JSON from an untrusted source is     vulnerable, including those that use GraphQL::Client to load external     schemas via GraphQL introspection.

    For Debian 11 bullseye, this problem has been fixed in version     1.11.12-0+deb11u1.

    We recommend that you upgrade your ruby-graphql packages.

    For the detailed security status of ruby-graphql please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/ruby-graphql

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:3492 advisory.

    Red Hat Satellite is a system management solution that allows organizations     to configure and maintain their systems without the necessity to provide     public Internet access to their servers or other client systems. It     performs provisioning and configuration management of predefined standard     operating environments.

    Security Fix(es):

    * rubygem-graphql: Remote code execution when loading a crafted GraphQL schema (CVE-2025-27407)

    * rubygem-rack: Local File Inclusion in Rack::Static (CVE-2025-27610)

    Users of Red Hat Satellite are advised to upgrade to these updated     packages, which fix these bugs.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:3491 advisory.

    Red Hat Satellite is a system management solution that allows organizations     to configure and maintain their systems without the necessity to provide     public Internet access to their servers or other client systems. It     performs provisioning and configuration management of predefined standard     operating environments.

    Security Fix(es):

    * rubygem-graphql: Remote code execution when loading a crafted GraphQL schema (CVE-2025-27407)

    * rubygem-rack: Local File Inclusion in Rack::Static (CVE-2025-27610)

    * python-jinja2: Jinja has a sandbox breakout through malicious filenames (CVE-2024-56201)

    Users of Red Hat Satellite are advised to upgrade to these updated     packages, which fix these bugs.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - graphql-ruby is a Ruby implementation of GraphQL. Starting in version 1.11.5 and prior to versions 1.11.8,     1.12.25, 1.13.24, 2.0.32, 2.1.14, 2.2.17, and 2.3.21, loading a malicious schema definition in     `GraphQL::Schema.from_introspection` (or `GraphQL::Schema::Loader.load`) can result in remote code     execution. Any system which loads a schema by JSON from an untrusted source is vulnerable, including those     that use GraphQL::Client to load external schemas via GraphQL introspection. Versions 1.11.8, 1.12.25,     1.13.24, 2.0.32, 2.1.14, 2.2.17, and 2.3.21 contain a patch for the issue. (CVE-2025-27407)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:3490 advisory.

    Red Hat Satellite is a system management solution that allows organizations     to configure and maintain their systems without the necessity to provide     public Internet access to their servers or other client systems. It     performs provisioning and configuration management of predefined standard     operating environments.

    Security Fix(es):

    * rubygem-rack: Local File Inclusion in Rack::Static (CVE-2025-27610)

    * rubygem-graphql: Remote code execution when loading a crafted GraphQL schema (CVE-2025-27407)

    Users of Red Hat Satellite are advised to upgrade to these updated     packages, which fix these bugs.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
421115	SCA: security update for graphql (GHSA-q92j-grw3-h492)	Tenable Cloud Security	SCA Checks	3/13/2025	7/2/2026	critical
421115	SCA: security update for graphql (GHSA-q92j-grw3-h492)	Tenable Self-Hosted Container Security	SCA Checks	3/13/2025	7/2/2026	critical
232721	FreeBSD : Gitlab -- Vulnerabilities (a435609c-ffd5-11ef-b4e4-2cf05da270f3)	Nessus	FreeBSD Local Security Checks	3/14/2025	3/28/2025	critical
235426	RHEL 9 : Satellite 6.17.0 (Important) (RHSA-2025:4576)	Nessus	Red Hat Local Security Checks	5/7/2025	6/5/2025	medium
243314	Debian dla-4263 : ruby-graphql - security update	Nessus	Debian Local Security Checks	8/4/2025	8/4/2025	critical
233923	RHEL 8 : Satellite 6.14.4.5 Async Update (Important) (RHSA-2025:3492)	Nessus	Red Hat Local Security Checks	4/5/2025	6/6/2025	critical
233927	RHEL 8 : Satellite 6.15.5.2 Async Update (Important) (RHSA-2025:3491)	Nessus	Red Hat Local Security Checks	4/5/2025	6/6/2025	medium
252346	Linux Distros Unpatched Vulnerability : CVE-2025-27407	Nessus	Misc.	8/20/2025	7/25/2026	critical
233911	RHEL 8 / 9 : Satellite 6.16.4 Async Update (Important) (RHSA-2025:3490)	Nessus	Red Hat Local Security Checks	4/5/2025	6/6/2025	critical

Detections

Analytics

Plugins Search

critical

critical

critical

medium

critical

critical

medium

critical

critical