Insecure Deserialization (ARCH6109)

Key ruby.security.insecure-deserialization · Severity critical · Category security · CWE CWE-502

Deserializing untrusted data with Marshal.load or unsafe YAML loading lets attackers instantiate arbitrary objects via gadget chains and achieve remote code execution. Use data-only formats.

Incorrect

def restore(blob)
  Marshal.load(blob)
end

restore(request.body.read)

Correct

require "json"

def restore(blob)
  JSON.parse(blob, symbolize_names: true)
end

restore(request.body.read)

Fix

Avoid Marshal.load/unsafe YAML; prefer JSON or YAML.safe_load for untrusted data.