GraphQL::Language::Cache#fetch reads parser cache files and passes their contents directly to Marshal.load without authenticating the payloads. If an attacker can place a crafted payload in the expected path and the application calls GraphQL::Language::Parser.parse_file, then attacker-controlled marshal_load or _load methods are executed, resulting in arbitrary Ruby code execution in the application process.