CLAIM-2026-09-14-07

RubyHack describes remote code execution on RubyDoc.info documentation workers achieved by having the documentation build evaluate a .yardopts file shipped inside the package, with results exfiltrated as newly published gems.

Why it matters

Code execution came from the documentation build path, not from package installation. A threat model for registries that stops at install stops too early.

Sources

• rubyhack2026openai