A critical remote code execution vulnerability exists in the graphql Ruby library when loading a crafted GraphQL schema using GraphQL::Schema.from_introspection or GraphQL::Schema::Loader.load. Systems that load schema JSON from untrusted sources, including those using GraphQL::Client for external schema introspection, are vulnerable. Multiple versions prior to fixed releases are affected.