Gem::SafeMarshal escape / nastystereo.com

In September 2023, Ruby added Gem::SafeMarshal in an attempt to make deserialization while processing packaged library .gem files safer. I decided to learn how it works and take on the challenge of breaking it to execute arbitrary commands. # How to use Gem::SafeMarshal Gem::SafeMarshal can be loaded by requiring rubygems/safe_marshal or calling Gem.load_safe_marshal. Gem::SafeMarshal defines two methods, safe_load and load. With the load method you specify which classes, symbols and instance variables are permitted, whereas the safe_load method has a hardcoded list of what is permitted.