Spring for GraphQL implementations that handle paginated queries are susceptible to unsafe deserialization, allowing an attacker to supply crafted data that can lead to arbitrary code execution. The flaw arises from deserializing input without proper validation, which can compromise confidentiality, integrity, and availability of the application. The potential impact is full compromise of the affected system if an attacker gains control of the deserialization process.

The vulnerability affects Spring for GraphQL versions 2.0.0 through 2.0.4. Users running these release ranges are at risk until a patch is applied. No other product versions are listed as affected.

The exploitability of this flaw is determined by the possibility of an attacker inserting malicious payloads into paginated GraphQL requests. While the EPSS score is unavailable and the vulnerability is not listed in the CISA KEV catalog, the nature of unsafe deserialization typically grants attackers remote code execution capabilities. No publicly known exploits have been documented, but the lack of mitigation creates a high potential risk if an attacker can influence the data flow.