AIKIDO-2026-148446
faraday-http-cache is vulnerable to Insecure Deserialization
81
High Risk
This Affects:
faraday-http-cacheTL;DR
Faraday::HttpCache deserializes cached entries with JSON.load, which honors create_additions and instantiates whatever Ruby class a json_class key names inside the cached data. Cache entries store response headers verbatim, so a header named json_class from the origin plants a class name that gets instantiated the next time the entry is read, and a class defining a matching json_create method then runs on that untrusted data. The fix reads entries with JSON.parse instead, which only ever builds plain hashes and never instantiates classes.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you cache responses from an origin whose response headers are not fully trusted.
Background info
faraday-http-cache is vulnerable to Insecure Deserialization in versions 2.0.0 - 2.7.0.
How to fix this
Upgrade the faraday-http-cache library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.