CVE-2025-22151

CVE-2025-22151 is a type confusion vulnerability in Strawberry GraphQL's relay integration, affecting versions 0.182.0 through 0.256.0, particularly when used with ORMs like Django, SQLAlchemy, and Pydantic. This flaw allows an attacker to query for one GraphQL type and receive an instance of a different, potentially more sensitive type mapped to the same underlying model. Rated with a CVSS score of 3.7 (LOW), the vulnerability has a network attack vector and high attack complexity, primarily leading to information disclosure and potential privilege escalation. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.