corpus.blog
42,390 blogs · 5,361,753 posts Claim your blog
Record · corpus.blog/posts/01a0fcb0-b475-70f0-8435-478f482b5b86

Ruby 4.0 Universal RCE Deserialization Gadget Chain - elttam

elttam.com · published 26 August 2026

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at elttam.com Wayback capture
1blogs citing
First cited
17 Aug 2026
Most recent
17 Aug 2026
Rank this month
not ranked
External links
22
Words captured
3,266

Cited by

Blog
In the post
Date
PentesterLab
Research Worth Reading - Week 33, 2026 Read at the source ↗
17 Aug 2026

Links from this post

Link
Host
https://www.youtube.com/watch?v=87DyyMV0kCY
youtube.com
https://nastystereo.com/security/ruby-3.4-deserialization.html
nastystereo.com
https://en.wikipedia.org/wiki/Serialization
en.wikipedia.org
https://github.com/haileys/old-website/blob/90a01589abe3385ecc8202c9a276a184be4b4602/posts/rails-3.2.10-remote-code-execution.md
github.com
https://bugs.ruby-lang.org/issues/7759
bugs.ruby-lang.org
https://phrack.org/issues/69/12
phrack.org
https://hackerone.com/reports/473888
hackerone.com
https://staaldraad.github.io/post/2019-03-02-universal-rce-ruby-yaml-load/
staaldraad.github.io
https://www.zerodayinitiative.com/blog/2019/6/20/remote-code-execution-via-ruby-on-rails-active-storage-insecure-deserialization
zerodayinitiative.com
https://devcraft.io/2021/01/07/universal-deserialisation-gadget-for-ruby-2-x-3-x.html
devcraft.io
https://staaldraad.github.io/post/2021-01-09-universal-rce-ruby-yaml-load-updated/
staaldraad.github.io
https://github.com/httpvoid/writeups/blob/main/Ruby-deserialization-gadget-on-rails.md
github.com
https://devcraft.io/2022/04/04/universal-deserialisation-gadget-for-ruby-2-x-3-x.html
devcraft.io
https://bishopfox.com/blog/ruby-vulnerabilities-exploits
bishopfox.com
Discovering Deserialization Gadget Chains in Rubyland
blog.includesecurity.com
https://github.blog/security/vulnerability-research/execute-commands-by-sending-json-learn-how-unsafe-deserialization-vulnerabilities-work-in-ruby-projects/
github.blog
https://github.com/GitHubSecurityLab/ruby-unsafe-deserialization/pull/1
github.com
https://nastystereo.com/security/ruby-safe-marshal-escape.html
nastystereo.com
https://blog.trailofbits.com/2025/08/20/marshal-madness-a-brief-history-of-ruby-deserialization-exploits/
blog.trailofbits.com
https://github.com/ruby/rubygems/commit/62b49465f8f770ebbee51d7cb4de7745cbb0d78c
github.com
https://github.com/ruby/rubygems/commit/89ad04db867dedb6ec9d78dd891ca69e2ef275a5
github.com
https://github.com/frohoff/ysoserial
github.com
Elsewhere on elttam.com (2)