Code execution via unrestricted object restoration

Object injection in Ruby RDoc 6.3.3 through 6.6.2 allows remote attackers to execute code through crafted configuration or cache files. The .rdoc_options parser restores YAML objects without restricting permitted classes, while documentation-cache loaders pass attacker-controlled bytes to Marshal.load without an object filter. Exploitation requires an RDoc process to parse an attacker-supplied .rdoc_options file or load a crafted documentation cache, after which code runs with that process's privileges.