AIKIDO-2026-41159

TL;DR

Psych resolves the !ruby/encoding tag by calling ::Encoding.find directly instead of using the restricted class loader, so safe_load returns an Encoding object even when no classes are permitted. The container tags !ruby/hash, !map:, !ruby/hash-with-ivars, !ruby/array, !seq:, and !ruby/string load the class named in the tag without checking that it is a subclass of the expected Hash, Array, or String, so a crafted document can allocate any permitted class and then call replace, push, or []= on the uninitialized instance, or write instance variables onto it, skipping init_with and returning an instance whose state holds types the class never accepts. The fix registers Encoding with the class loader and rejects tags whose target is not a subclass of the expected Hash, Array, or String.