The Puppet/OpenVox report is a JSON document the agent sends to the
server after each enforcement run. It details what changes were
made, any warnings or error messages, and any resources that failed
to apply correctly. It also contains a full list of all events that
happened, where an event might be “content <foo> changed to
<bar>” or the like. In some circumstances involving custom
resource types, an event might include a serialized Ruby object
(programming code turned into text) instead of just plain JSON. When
the report is processed, these objects are deserialized back into
something the compiler can use. Unfortunately a malicious event
object can be constructed in such a way that code executes on the
server when this happens.