Marshal.load on untrusted data can instantiate arbitrary objects and execute code.
Never deserialize untrusted data with Marshal; use JSON with a strict schema instead.