Ruby 4.0 Universal RCE Deserialization Gadget Chain
A new universal gadget chain turns a single Marshal.load into command execution on Ruby 4.0.6, the latest release. It works unchanged on Ruby 3.3 and above. The chain reuses old gadgets in new ways and introduces new ones, bypassing the fixes that broke the previous 3.4 chain. It exploits a Time deserialization quirk and a directory traversal to write and execute arbitrary code.
Removing it would mean changing the way core data structures behave, which is exactly the kind of tradeoff where a gadget can be cheap to use and expensive to forbid.