Explain custom Serialization mechanics: Marshal, JSON, and YAML safety vectors.

Serialization converts objects into transportable formats. Using Marshal.load or unsafe YAML parsers on untrusted user input can lead to remote code execution (RCE) vulnerabilities.

Ruby provides built-in tools like Marshal to serialize complex object trees into binary streams. However, Marshal.load deserializes raw objects completely, including their class definitions and internal states. If an attacker controls the binary data, they can craft malicious payloads that trigger specific methods (gadget chains) during deserialization, leading to Remote Code Execution (RCE). Similar risks exist with older YAML parsers. For untrusted input, always use data-only formats like JSON or safe YAML parsing options.