Despite this Ruby should have requested CVE numbers. They created a patch that was available to install and prevented this attack. CVE numbers would have triggered automations to update Ruby in everyones systems.