VYPR
← All advisories
High severity8.1NVD Advisory· Published Apr 24, 2026· Updated Apr 29, 2026

CVE-2026-41316

CVE-2026-41316

Description

ERB is a templating system for Ruby. Ruby 2.7.0 (before ERB 2.2.0 was published on rubygems.org) introduced an @_init instance variable guard in ERB#result and ERB#run to prevent code execution when an ERB object is reconstructed via Marshal.load (deserialization). However, three other public methods that also evaluate @src via eval() were not given the same guard: ERB#def_method, ERB#def_module, and ERB#def_class. An attacker who can trigger Marshal.load on untrusted data in a Ruby application that has erb loaded can use ERB#def_module (zero-arg, default parameters) as a code execution sink, bypassing the @_init protection entirely. ERB 4.0.3.1, 4.0.4.1, 6.0.1.1, and 6.0.4 patch the issue.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
erbRubyGems
< 4.0.3.14.0.3.1
erbRubyGems
>= 4.0.4, < 4.0.4.14.0.4.1
erbRubyGems
>= 5.0.0, < 6.0.1.16.0.1.1
erbRubyGems
>= 6.0.2, < 6.0.46.0.4

Affected products

67

Patches

Vulnerability mechanics

References

4

News mentions

0

No linked articles in our index yet.