All rules →
Rules / Ruby
SHIELD-RUBY-013

Unsafe deserialization via YAML.load or Oj object mode

criticalRubyCWE-502CVSS 9.8

What it detects

YAML.load or Oj in object mode on untrusted input can instantiate arbitrary Ruby objects.

How to fix

Use YAML.safe_load or Oj with :strict mode to reject arbitrary object instantiation.

Scan your repo freeFull documentation
Back to all rules
SHIELD-RUBY-013: Unsafe deserialization via YAML.load or Oj object mode — Zennoxa Shield