Looks like this is actually an ActiveModel vulnerability and maybe mongoid is affected too. Just like when rails people said they had a vulnerability in action

Looks like this is actually an ActiveModel vulnerability and maybe mongoid is affected too. Just like when rails people said they had a vulnerability in action dispatch but it was actually a YAML vulnerability. (both used in a lot of non-rails projects) So please don't overlook this issue even if you are not using rails.