The Pixar ruby-jss gem before 1.6.0 allows remote attackers to execute arbitrary code because of the Plist gem's documented behavior of using Marshal.load during XML document processing.
CVSS 3.1CRITICAL 9.8·Network·No auth·No interaction·EPSS 0.02603·Published 2021-05-25·Fixed in 1.6.0