AIKIDO-2025-10944

TL;DR

Affected versions of this package are vulnerable to unsafe deserialization because the Session.deserialize method uses Oj.load without safe mode, allowing instantiation of arbitrary Ruby objects from untrusted serialized data. This may allow an attacker who can influence the serialized session payload to trigger unintended object creation during deserialization. The issue is mitigated by removing the Session.serialize and Session.deserialize methods, which are no longer necessary since session storage is the responsibility of the application and sessions should be reconstructed explicitly using Session.new() with individually stored attributes.