strawberry-graphql strawberry up to 0.256.x type confusion

Summaryinfo

A vulnerability identified as problematic has been detected in strawberry-graphql strawberry up to 0.256.x. Affected by this vulnerability is an unknown functionality. Performing a manipulation results in type confusion. This vulnerability is reported as CVE-2025-22151. The attack is possible to be carried out remotely. No exploit exists. You should upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, was found in strawberry-graphql strawberry up to 0.256.x. This affects some unknown functionality. The manipulation with an unknown input leads to a type confusion vulnerability. CWE is classifying the issue as CWE-843. The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type. This is going to have an impact on confidentiality. The summary by CVE is:

Strawberry GraphQL is a library for creating GraphQL APIs. Starting in 0.182.0 and prior to version 0.257.0, a type confusion vulnerability exists in Strawberry GraphQL's relay integration that affects multiple ORM integrations (Django, SQLAlchemy, Pydantic). The vulnerability occurs when multiple GraphQL types are mapped to the same underlying model while using the relay node interface. When querying for a specific type using the global node field (e.g., FruitType:some-id), the resolver may incorrectly return an instance of a different type mapped to the same model (e.g., SpecialFruitType). This can lead to information disclosure if the alternate type exposes sensitive fields and potential privilege escalation if the alternate type contains data intended for restricted access. This vulnerability is fixed in 0.257.0.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2025-22151 since 12/30/2024. The exploitability is told to be difficult. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 0.257.0 eliminates this vulnerability. Applying the patch 526eb82b70451c0e59d5a71ae9b7396f59974bd8 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• strawberry-graphql

Name

• strawberry

Version

• 0.256

License

• open-source

Website

• Product: https://github.com/strawberry-graphql/strawberry/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion