CVE-2026-33286

Graphiti is an API framework that exposes data models via JSON:API. Packages prior to version 1.10.2 contain code that evaluates relationship names from client payloads without validation. When a write operation (create, update, delete) is called, the library recursively invokes model.send(name) on the supplied relationship names. This behavior allows an attacker who can send a malicious JSON:API payload to trigger any public method defined on the model instance, the model class, or its associations. The result can be arbitrary code execution, data manipulation, or other destructive actions, depending on the methods exposed by the application. The weakness is consistent with CWE‑913, representing vulnerability that permits an attacker to invoke unintended methods via improper input handling.

Entities affected are applications built with Graphiti core library graphiti before version 1.10.2. The vulnerability is present in any codebase using the Graphiti JSONAPI write endpoints exposed to untrusted users. The product is the Ruby gem graphiti; any Rails or Ruby application that incorporates Graphiti for RESTful interfaces is at risk if those endpoints are reachable from external input. The commit reference showing the altered code and the release tag v1.10.2 are the primary indicators of the affected release range.

The vulnerability scores 9.1 on CVSS, indicating critical severity. EPSS below 1% shows the probability of widespread active exploitation is low at present, and it is not listed in the CISA KEV catalog. Nevertheless, the attack vector is HTTPS or HTTP to the write API, which can be reached by any authenticated or unauthenticated user if the endpoint is not protected. Because the flaw permits arbitrary method calls, a successful exploit could lead to data tampering, privilege escalation or denial of service. The advisory recommends upgrading immediately and applying access controls before the write operation; otherwise the risk remains high for any exposed Graphiti write interfaces.