AIKIDO-2026-757268
graphql is vulnerable to Deserialization of Untrusted Data
78
High Risk
This Affects:
graphqlTL;DR
GraphQL-Ruby can cache parsed GraphQL documents to disk and reloads them with Marshal.load in GraphQL::Language::Cache. GraphQL::Language::Parser.parse_file deserializes the cached payload without verifying its authenticity, so a crafted Marshal payload written to the cache path is loaded as trusted data. Deserializing an untrusted payload can instantiate arbitrary Ruby objects and execute code inside the application process. The fix signs parser cache payloads and validates them before loading.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application enables the parser cache and loads cached GraphQL documents from a path that untrusted input can write to.
Background info
graphql is vulnerable to Deserialization of Untrusted Data in versions 1.12.6 - 2.6.8.
How to fix this
Upgrade the graphql library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant