I think you&#x27;re overextrapolating here, though I admit my knowledge on this isn&#x27;t totally up to date.<p>As I understand it, Ruby&#x27;s Marshal function, which takes text data and deserializes it, <i>is not safe by default</i>. So, is that a flaw of Ruby? I <i>guess</i>...except that this kind of serialization seems to be a standard feature in languages (well, Ruby and Python, the two things I currently use):<p><a href="https:&#x2F;&#x2F;docs.python.org&#x2F;3&#x2F;library&#x2F;pickle.html" rel="nofollow">https:&#x2F;&#x2F;docs.python.org&#x2F;3&#x2F;library&#x2F;pickle.html</a><p>&gt; <i>Warning The pickle module is not secure against erroneous or maliciously constructed data. Never unpickle data received from an untrusted or unauthenticated source.</i><p>So the true bug seems to be that in Rails ActiveSupport (in a deprecated class, which uses some of Ruby&#x27;s fun meta magic to deal with missing methods -- so basically, the classic obfuscation of functionality as a tradeoff for some sugary magic, all in a deprecated function that likely no one revisits), you can trigger a set of functions and routines in which the final decoding step, for whatever reason, ends up invoking Ruby&#x27;s Marshal (via Rack: <a href="http:&#x2F;&#x2F;www.rubydoc.info&#x2F;github&#x2F;rack&#x2F;rack&#x2F;Rack&#x2F;Session&#x2F;Cookie&#x2F;Base64&#x2F;Marshal#decode-instance_method" rel="nofollow">http:&#x2F;&#x2F;www.rubydoc.info&#x2F;github&#x2F;rack&#x2F;rack&#x2F;Rack&#x2F;Session&#x2F;Cookie...</a>)