Tag
This post releases a new universal Ruby deserialization gadget chain that turns a single Marshal.load into command execution on Ruby 4.0.6, working unchanged back to Ruby 3.3, built from both new and repurposed gadgets.
Disclosed a deserialization bypass vulnerability (F1) in fastjson2 ≤ 2.0.64 that can bypass AutoType blacklist validation; the official fix has been merged into the main branch but not yet released.