CVE-2025-59845

Apollo Studio Embeddable Explorer & Embeddable Sandbox are website embeddable software solutions from Apollo GraphQL. Prior to Apollo Sandbox version 2.7.2 and Apollo Explorer version 3.7.3, a cross-site request forgery (CSRF) vulnerability was identified. The vulnerability arises from missing origin validation in the client-side code that handles window.postMessage events. A malicious website can send forged messages to the embedding page, causing the victim’s browser to execute arbitrary GraphQL queries or mutations against their GraphQL server while authenticated with the victim’s cookies. This issue has been patched in Apollo Sandbox version 2.7.2 and Apollo Explorer version 3.7.3.

• CWE-346
• CWE-352

• https://github.com/apollographql/embeddable-explorer/security/advisories/GHSA-w87v-7w53-wwxv

Published

Sep 26, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-5984A vulnerability has been found in SourceCodester Online Stud…5.4
• CVE-2025-59840Vega is a visualization grammar, a declarative format for cr…8.1
• CVE-2025-59841Flag Forge is a Capture The Flag (CTF) platform. In versions…9.8
• CVE-2025-59842jupyterlab is an extensible environment for interactive and …4.3
• CVE-2025-59843Flag Forge is a Capture The Flag (CTF) platform. From versio…5.3
• CVE-2025-59844SonarQube Server and Cloud is a static analysis solution for…7.7
• CVE-2025-59849Improper management of Content Security Policy in HCL BigFix…6.1
• CVE-2025-5985A vulnerability was found in code-projects School Fees Payme…7.3
• CVE-2025-59851HCL DFXAnalytics is affected by a Using Components with Know…9.8
• CVE-2025-59852HCL DFXAnalytics is affected by an Insufficient Transport …9.1
• CVE-2025-59853HCL DFXAnalytics is affected by an Improper Error Handling v…5.3
• CVE-2025-59854HCL DFXAnalytics is affected by an Insecure Security Header …6.1