{"cve":"CVE-2025-59845","nvd":{"published":"2025-09-26T23:15:31.640","modified":"2026-10-09T10:10:00.193","status":"Deferred","description":"Apollo Studio Embeddable Explorer & Embeddable Sandbox are website embeddable software solutions from Apollo GraphQL. Prior to Apollo Sandbox version 2.7.2 and Apollo Explorer version 3.7.3, a cross-site request forgery (CSRF) vulnerability was identified. The vulnerability arises from missing origin validation in the client-side code that handles window.postMessage events. A malicious website can send forged messages to the embedding page, causing the victim’s browser to execute arbitrary GraphQL queries or mutations against their GraphQL server while authenticated with the victim’s cookies. This issue has been patched in Apollo Sandbox version 2.7.2 and Apollo Explorer version 3.7.3.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N","score":8.2},"cwes":["CWE-346","CWE-352"],"references":["https://github.com/apollographql/embeddable-explorer/security/advisories/GHSA-w87v-7w53-wwxv"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:10:08.713834912+00:00"},"epss":{"cve":"CVE-2025-59845","score":0.00159,"percentile":0.05033,"date":"2026-10-25"},"kev":null,"osv":[{"id":"GHSA-w87v-7w53-wwxv","url":"https://osv.dev/vulnerability/GHSA-w87v-7w53-wwxv","summary":"Apollo Embedded Sandbox and Explorer vulnerable to CSRF via window.postMessage origin-validation bypass","modified":"2025-09-29T14:03:00Z","packages":[{"ecosystem":"npm","name":"@apollo/sandbox","purl":"pkg:npm/%40apollo/sandbox","ranges":["<2.7.2"],"fixed":["2.7.2"]},{"ecosystem":"npm","name":"@apollo/explorer","purl":"pkg:npm/%40apollo/explorer","ranges":["<3.7.3"],"fixed":["3.7.3"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}