Collected research

Ruby 3.4 Universal RCE Deserialization Gadget Chain

Ruby 3.4 Universal RCE Deserialization Gadget Chain / nastystereo.com

Luke Jahnke · nastystereo.com

Refits the universal Ruby deserialisation gadget chain for Ruby 3.4: reaches the URI class through RubyGems' vendored copy via an autoload, swaps the zip sink for tools that ship in official Ruby images, and hides the trailing exception behind an error whose string conversion satisfies the version regex. One deserialisation of attacker data gives command execution.

Record

Document

Ruby 3.4 Universal RCE Deserialization Gadget Chain / nastystereo.com

Researcher

Luke Jahnke

Published by

nastystereo.com

Topic

Server

In the archive

• Collected in the 2024 research round

Tags

• gadget-chain
• deserialization
• rce
• command-injection
• ruby
• prior-art-extension
• owasp-a03-2021
• owasp-a08-2021

This page is the archive's own catalogue record. The research is the work of Luke Jahnke, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 11 August 2026.