GHSA-p8jg-8p9f-pgmr

High

Published: —Translated: 23/09/2026(UTC)NVD NIST

Summary

The faraday-http-cache library stores cached responses in JSON format by default and reads them back using JSON.load, which honors the json_class key and calls json_create on the named class. Response headers are stored verbatim in the cache entry, so a malicious origin server can return a response with a json_class key leading to unsafe deserialization.

Risk Assessment

An attacker could exploit this vulnerability to execute arbitrary code or instantiate dangerous objects within the application process, potentially leading to server compromise or data leakage.

Recommendation

Recommend avoiding the default JSON module for deserializing responses or ensuring the cache is not shared with untrusted origins. Also validate and restrict allowed classes during deserialization.

Other vulnerabilities in faraday-http-cache

GHSA-c33f-42f2-gwccMedium
The faraday-http-cache library acts as a shared cache by default (shared_cache: true). The ByUrl strategy keys entries on method and URL and treats a cached response without a Vary header as matching every request, while the ByVary strategy relies on the origin listing Authorization in Vary. A response to a request... (description truncated) may be improperly served to other users.

Original NVD description (English source)

faraday-http-cache stores cached responses with the JSON module by default and reads them back with JSON.load, which honours the json_class key and calls json_create on the named class. Response headers are stored verbatim inside the cache entry, so an origin server that returns a json_class respons