How severe is unsafe deserialization via marshal.load?

Shield rates this critical (CVSS 9.8), classified as CWE-502.

Rules / Ruby

SHIELD-RUBY-012

Unsafe deserialization via Marshal.load

criticalRubyCWE-502CVSS 9.8

Marshal.load on untrusted data can instantiate arbitrary objects and execute code.

Never deserialize untrusted data with Marshal; use JSON with a strict schema instead.

Vulnerable — Shield flags thissession_cache.rb

class SessionCache
  def read(key)
    raw = redis.get(key)
    Marshal.load(raw) if raw
  end
end

Fixed — scans cleansession_cache.rb

require "json"

class SessionCache
  def read(key)
    raw = redis.get(key)
    JSON.parse(raw, symbolize_names: true) if raw
  end
end

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-RUBY-012, the fixed one does not.