ruby/rubygems · error · Gem::SafeMarshal::Visitors::ToRuby::UnpermittedClassError

Attempting to load unpermitted class #{name.inspect} @ #{sta

Error message

Attempting to load unpermitted class #{name.inspect} @ #{stack.join(".")}

What it means

Error "Attempting to load unpermitted class #{name.inspect} @ #{stack.join(".")}" thrown in ruby/rubygems.

Source

Thrown at lib/rubygems/safe_marshal/visitors/to_ruby.rb:291

            push_stack k
            hash[k] = visit(v)
          end

          if o.is_a?(Elements::HashWithDefaultValue)
            push_stack :default
            hash.default = visit(o.default)
          end

          hash
        else
          raise UnsupportedError.new("Unsupported user class #{resolve_class(r.name)} in marshal stream", stack: formatted_stack)
        end
      end

      def resolve_class(n)
        @class_cache[n] ||= begin
          to_s = resolve_symbol_name(n)
          raise UnpermittedClassError.new(name: to_s, stack: formatted_stack) unless @permitted_classes.include?(to_s)
          visit_symbol_type(n)
          begin
            ::Object.const_get(to_s)
          rescue NameError
            raise ArgumentError, "Undefined class #{to_s.inspect}"
          end
        end
      end

      class RationalCompat
        def marshal_load(s)
          num, den = s
          raise ArgumentError, "Expected 2 ints" unless s.size == 2 && num.is_a?(Integer) && den.is_a?(Integer)
          Rational(num, den)
        end
      end
      private_constant :RationalCompat

View on GitHub (pinned to 86cbb817a3)

Solutions

1. Do not install the gem: its metadata tries to load a class outside the permitted set
2. Fetch the gem from the official source and report the tampered package

When it happens

Trigger: Thrown at lib/rubygems/safe_marshal/visitors/to_ruby.rb:291 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of ruby/rubygems@86cbb817a3 (2026-08-23). Data as JSON: /api/errors/dcbad162b357ea04. Report an issue: GitHub.