New Ruby RCE Gadget Chain Turns Unsafe Marshal.load Into Command Execution
Brief
A newly disclosed universal deserialization gadget chain demonstrates that a single unsafe Marshal. load operation can lead to remote command execution on Ruby 4.
- 6.
The chain reportedly also works unchanged on Ruby versions as far back as 3.3, renewing concerns that Ruby’s native serialization mechanism remains a high-risk attack surface when exposed to untrusted data.
The research builds on more than a decade of Ruby deserialization exploitation, including prior chains targeting Ruby on Rails , YAML.load , RubyGems, and the standard library.
New Ruby RCE Gadget Chain Turns Unsafe Marshal.load
Unlike older proofs-of-concept that stopped working after changes in Ruby 3.4, the latest chain uses a new combination of RubyGems and core language features to execute code without requiring application-specific dependencies or pre-existing files on the target host.