elttam publishes a universal Ruby deserialization gadget chain that reaches command execution from one Marshal.load

Sources: primary, discussion
Summary: elttam published a universal deserialization gadget chain for Ruby that reaches command execution from a single Marshal.load call. The post states the chain needs no application code, no extra gems and no prior state on disk. It reports the chain works unchanged from Ruby 3.3 through the current 4.0.6 release.
Why it matters: A code path that deserializes untrusted input with Marshal.load is exposed on a current Ruby release with no application-specific gadget required, subject to two further conditions the post states: the target must fetch the deflated payload over HTTPS from the host named in the payload, and it must be able to write to a directory such as /tmp.