Updated advisory posts against rubysec/ruby-advisory-db@b24e1ff

Author: jasnow

advisories/_posts/2026-03-20-CVE-2026-33286.md

@@ -0,0 +1,61 @@
+---
+layout: advisory
+title: 'CVE-2026-33286 (graphiti): Graphiti Affected by Arbitrary Method Execution
+  via Unvalidated Relationship Names'
+comments: false
+categories:
+- graphiti
+advisory:
+  gem: graphiti
+  cve: 2026-33286
+  ghsa: 3m5v-4xp5-gjg2
+  url: https://github.com/graphiti-api/graphiti/security/advisories/GHSA-3m5v-4xp5-gjg2
+  title: Graphiti Affected by Arbitrary Method Execution via Unvalidated Relationship
+    Names
+  date: 2026-03-20
+  description: |
+    ### Summary
+
+    An arbitrary method execution vulnerability has been found which
+    affects Graphiti's JSONAPI write functionality. An attacker can
+    craft a malicious JSONAPI payload with arbitrary relationship
+    names to invoke any public method on the underlying model
+    instance, class or its associations.
+
+    ### Impact
+
+    Any application exposing Graphiti write endpoints (create/update/delete)
+    to untrusted users is affected.
+
+    The `Graphiti::Util::ValidationResponse#all_valid?` method recursively
+    calls `model.send(name)` using relationship names taken directly from
+    user-supplied JSONAPI payloads, without validating them against the
+    resource's configured sideloads. This allows an attacker to potentially
+    run any public method on a given model instance, on the instance class
+    or associated instances or classes, including destructive operations.
+
+    ### Patches
+
+    This is patched in Graphiti **v1.10.2**.
+    Users should upgrade as soon as possible.
+
+    ### Workarounds
+
+    If upgrading to v1.10.2 is not immediately possible, consider one
+    or more of the following mitigations:
+
+    - **Restrict write access**: Ensure Graphiti write endpoints
+      (create/update/delete) are not accessible to untrusted users.
+    - **Authentication & authorisation**: Apply strong authentication
+      and authorisation checks before any write operation is processed,
+      for example use Rails strong parameters to ensure only valid
+      parameters are processed."
+  cvss_v3: 9.1
+  patched_versions:
+  - ">= 1.10.2"
+  related:
+    url:
+    - https://github.com/graphiti-api/graphiti/security/advisories/GHSA-3m5v-4xp5-gjg2
+    - https://gitlab.com/gitlab-org/security-products/gemnasium-db/-/blob/master/gem/graphiti/CVE-2026-33286.yml
+    - https://github.com/advisories/GHSA-3m5v-4xp5-gjg2
+---