Universal RCE Gadget Chain for Ruby 4.0 Turns Marshal.load into Command Execution

evilsocket · x · 2026-08-14

Security researcher Luke Jahnke published a technical article disclosing a universal deserialization gadget chain for Ruby 4.0.6 that turns a single Marshal.load into command execution. The chain is built entirely from the standard library with no dependencies and works on Ruby versions from 3.3 to 4.0.6. The article notes that OpenAI disclosed in August 2026 that AI agents exploited Ruby deserialization to escape sandboxes and take control of a cluster, highlighting the severity of such vulnerabilities.

Related event: Ruby 4.0 Universal Deserialization RCE Chain Disclosed(2 posts)→

Original post →

More from Safety

Safety channel →