GHSA-q92j-grw3-h492 graphql allows remote code execution when loading a crafted GraphQL schema

• RubyGems graphql: >= 2.4.0, < 2.4.13 → fixed in 2.4.13 • RubyGems graphql: >= 2.3.0, < 2.3.21 → fixed in 2.3.21 • RubyGems graphql: >= 2.2.0, < 2.2.17 → fixed in 2.2.17 • RubyGems graphql: >= 2.1.0, < 2.1.15 → fixed in 2.1.15 • RubyGems graphql: >= 2.0.0, < 2.0.32 → fixed in 2.0.32 • RubyGems graphql: >= 1.13.0, < 1.13.24 → fixed in 1.13.24 • RubyGems graphql: >= 1.12.0, < 1.12.25 → fixed in 1.12.25 • RubyGems graphql: >= 1.11.5, < 1.11.11 → fixed in 1.11.11

Summary Loading a malicious schema definition in `GraphQL::Schema.from_introspection` (or `GraphQL::Schema::Loader.load`) can result in remote code execution. Any system which loads a schema by JSON from an untrusted source is vulnerable, including those that use GraphQL::Client to load external schemas via GraphQL introspection.