CVE-2026-41316 PUBLISHED

ERB has an @_init deserialization guard bypass via def_module / def_method / def_class

Assigner: GitHub_M
Reserved: 20.04.2026 Published: 24.04.2026 Updated: 24.04.2026

ERB is a templating system for Ruby. Ruby 2.7.0 (before ERB 2.2.0 was published on rubygems.org) introduced an @_init instance variable guard in ERB#result and ERB#run to prevent code execution when an ERB object is reconstructed via Marshal.load (deserialization). However, three other public methods that also evaluate @src via eval() were not given the same guard: ERB#def_method, ERB#def_module, and ERB#def_class. An attacker who can trigger Marshal.load on untrusted data in a Ruby application that has erb loaded can use ERB#def_module (zero-arg, default parameters) as a code execution sink, bypassing the @_init protection entirely. ERB 4.0.3.1, 4.0.4.1, 6.0.1.1, and 6.0.4 patch the issue.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 8.1

Product Status

Vendor ruby
Product erb
Versions
  • Version < 4.0.3.1 is affected
  • Version = 4.0.4 is affected
  • Version >= 5.0.0, < 6.0.1.1 is affected
  • Version >= 6.0.2, < 6.0.4 is affected

References

Problem Types

  • CWE-693: Protection Mechanism Failure CWE