CVE-2025-59845: CSRF in Apollo GraphQL Explorer and Sandbox

CVE-2025-59845 describes a Cross-Site Request Forgery (CSRF) vulnerability identified in Apollo Studio Embeddable Explorer and Embeddable Sandbox components. These software solutions allow websites to embed an interactive GraphQL editor. The flaw lies in missing origin validation in window.postMessage handlers: a malicious website can send forged messages to the page containing the Apollo component, causing arbitrary GraphQL queries and mutations to be executed against the victim's GraphQL server, authenticated with the victim's own cookies.

The vulnerability is rated CVSS 8.2 (high). Affected versions are Apollo Sandbox prior to 2.7.2 and Apollo Explorer prior to 3.7.3. A patch has been released. Additionally, on November 8, 2026, a public repository on GitHub was reported containing a testing sandbox and proof-of-concept for exploiting the vulnerability, indicating that the hacker community has access to resources for testing the exploit.

Organizations embedding Apollo Explorer or Sandbox must prioritize inventory and version verification of their implementations. The immediate step is upgrading to Apollo Sandbox 2.7.2 or later and Apollo Explorer 3.7.3 or later. In parallel, evaluate adding security controls at the application level: verify that postMessage origins are strictly validated, ensure CORS configurations are restrictive, and ensure HTTP security policies are robust.