faraday-http-cache stores cached responses with the JSON module by default and reads them back with JSON.load, which honours the json_class key and calls json_create on the named class. Response headers are stored verbatim inside the cache entry, so an origin server that returns a json_class response header causes that class to be instantiated in the client process on the next cache hit. Any application that uses the middleware to fetch URLs it does not fully control is affected with the default configuration, through both the ByUrl and ByVary strategies.

NOTE: Versions 2.0.0 through 2.7.0 were confirmed by the reporter; the 1.x line was not tested but uses the same deserialization path.

CREDIT

Reported by Matthew Mongeau (Ruby Central / Project Glasswing).