The vulnerability stems from ActiveRecord's handling of serialized attributes using YAML. The YAMLColumn coder's load() method directly uses YAML.load, which by default allows deserialization of any class. When combined with mass assignment to serialized attributes (common in Rails models using serialize), this permits remote code execution via crafted YAML payloads. The advisory explicitly references the serialize helper's insecure deserialization behavior, and historical Rails security patches for similar issues target the YAMLColumn implementation.