Read the docs
TI-2026-29917 Aliases CVE-2026-41316GHSA-q339-8rmv-2mhv

ERB has an @_init deserialization guard bypass via def_module / def_method / def_class

Priority MEDIUM 40CWE-693Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-693.

Summary

ERB is a templating system for Ruby. Ruby 2.7.0 (before ERB 2.2.0 was published on rubygems.org) introduced an `@_init` instance variable guard in `ERB#result` and `ERB#run` to prevent code execution when an ERB object is reconstructed via `Marshal.load` (deserialization). However, three other public methods that also evaluate `@src` via `eval()` were not given the same guard: `ERB#def_method`, `ERB#def_module`, and `ERB#def_class`. An attacker who can trigger `Marshal.load` on untrusted data in a Ruby application that has `erb` loaded can use `ERB#def_module` (zero-arg, default parameters) as a code execution sink, bypassing the `@_init` protection entirely. ERB 4.0.3.1, 4.0.4.1, 6.0.1.1, and 6.0.4 patch the issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01131 66th percentileScored 2026-11-07
Fix Fixed erb (ruby): 4.0.3.1, 6.0.1.1, 6.0.4erb (RubyGems): 4.0.3.1, 4.0.4.1, 6.0.1.1 +1Red Hat: 13 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
rubyerbbefore 4.0.3.1; = 4.0.4; 5.0.0 to before 6.0.1.1; 6.0.2 to before 6.0.44.0.3.1, 6.0.1.1, 6.0.4Patch availableCNA
—erb (RubyGems)before 4.0.3.14.0.3.1Patch availableGHSA-q339-8rmv-2mhv
—erb (RubyGems)4.0.4 to before 4.0.4.14.0.4.1Patch availableGHSA-q339-8rmv-2mhv
—erb (RubyGems)5.0.0 to before 6.0.1.16.0.1.1Patch availableGHSA-q339-8rmv-2mhv
—erb (RubyGems)6.0.2 to before 6.0.46.0.4Patch availableGHSA-q339-8rmv-2mhv
  • erb Vendorruby Affected before 4.0.3.1; = 4.0.4; 5.0.0 to before 6.0.1.1; 6.0.2 to before 6.0.4 Fixed in 4.0.3.1, 6.0.1.1, 6.0.4 Patch available CNA
  • erb (RubyGems) Vendor— Affected before 4.0.3.1 Fixed in 4.0.3.1 Patch available GHSA-q339-8rmv-2mhv
  • erb (RubyGems) Vendor— Affected 4.0.4 to before 4.0.4.1 Fixed in 4.0.4.1 Patch available GHSA-q339-8rmv-2mhv
  • erb (RubyGems) Vendor— Affected 5.0.0 to before 6.0.1.1 Fixed in 6.0.1.1 Patch available GHSA-q339-8rmv-2mhv
  • erb (RubyGems) Vendor— Affected 6.0.2 to before 6.0.4 Fixed in 6.0.4 Patch available GHSA-q339-8rmv-2mhv

Remediation

  • Fix · CNA erb (ruby) Fixed in 4.0.3.1, 6.0.1.1, 6.0.4
  • Fix · GHSA-q339-8rmv-2mhv erb (RubyGems) Fixed in 4.0.3.1 Advisory →
  • Fix · GHSA-q339-8rmv-2mhv erb (RubyGems) Fixed in 4.0.4.1 Advisory →
  • Fix · GHSA-q339-8rmv-2mhv erb (RubyGems) Fixed in 6.0.1.1 Advisory →
  • Fix · GHSA-q339-8rmv-2mhv erb (RubyGems) Fixed in 6.0.4 Advisory →

Red Hat 13 advisories

  • RHSA-2026:37238 Released 2026-07-09 · Red Hat rating Important
    ruby:3.3 security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) ruby-3.3.10-6.module+el9.6.0+24475+76cce029.aarch64::ruby:3.3, ruby-3.3.10-6.module+el9.6.0+24475+76cce029.i686::ruby:3.3, ruby-3.3.10-6.module+el9.6.0+24475+76cce029.ppc64le::ruby:3.3 +47
  • RHSA-2026:35834 Released 2026-07-06 · Red Hat rating Important
    ruby security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) ruby-3.0.4-161.el9_2.3, ruby-default-gems-3.0.4-161.el9_2.3, ruby-devel-3.0.4-161.el9_2.3 +18
  • RHSA-2026:33478 Released 2026-06-30 · Red Hat rating Important
    ruby security update
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) ruby-3.3.10-11.el10_0.1, ruby-bundled-gems-3.3.10-11.el10_0.1, ruby-default-gems-3.3.10-11.el10_0.1 +20
    • Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) ruby-doc-3.3.10-11.el10_0.1
Show 10 more Red Hat advisories
  • RHSA-2026:33462 Released 2026-06-30 · Red Hat rating Important
    ruby security update
    • Red Hat CodeReady Linux Builder EUS (v.9.6) ruby-doc-3.0.7-165.el9_6.1
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) ruby-3.0.7-165.el9_6.1, ruby-default-gems-3.0.7-165.el9_6.1, ruby-devel-3.0.7-165.el9_6.1 +18
  • RHSA-2026:26655 Released 2026-06-17 · Red Hat rating Important
    ruby:3.3 security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.4) ruby-3.3.10-6.module+el9.4.0+24333+ed4ca411.aarch64::ruby:3.3, ruby-3.3.10-6.module+el9.4.0+24333+ed4ca411.i686::ruby:3.3, ruby-3.3.10-6.module+el9.4.0+24333+ed4ca411.ppc64le::ruby:3.3 +47
  • RHSA-2026:26312 Released 2026-06-16 · Red Hat rating Important
    ruby security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.4) ruby-3.0.7-162.el9_4.2, ruby-default-gems-3.0.7-162.el9_4.2, ruby-devel-3.0.7-162.el9_4.2 +18
  • RHSA-2026:20596 Released 2026-05-26 · Red Hat rating Important
    ruby:4.0 security update
    • Red Hat Enterprise Linux AppStream (v. 9) ruby-4.0.3-32.module+el9.8.0+24280+122d8796.aarch64::ruby:4.0, ruby-4.0.3-32.module+el9.8.0+24280+122d8796.i686::ruby:4.0, ruby-4.0.3-32.module+el9.8.0+24280+122d8796.ppc64le::ruby:4.0 +47
  • RHSA-2026:20614 Released 2026-05-26 · Red Hat rating Important
    ruby:3.3 security update
    • Red Hat Enterprise Linux AppStream (v. 8) ruby-3.3.10-6.module+el8.10.0+24247+b74f0fb8.aarch64::ruby:3.3, ruby-3.3.10-6.module+el8.10.0+24247+b74f0fb8.i686::ruby:3.3, ruby-3.3.10-6.module+el8.10.0+24247+b74f0fb8.ppc64le::ruby:3.3 +47
  • RHSA-2026:20670 Released 2026-05-26 · Red Hat rating Important
    ruby security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.0) ruby-3.0.4-160.2.el9_0, ruby-default-gems-3.0.4-160.2.el9_0, ruby-devel-3.0.4-160.2.el9_0 +18
  • RHSA-2026:20606 Released 2026-05-26 · Red Hat rating Important
    ruby4.0 security update
    • Red Hat Enterprise Linux AppStream (v. 10) ruby4.0-4.0.3-34.el10_2, ruby4.0-devel-4.0.3-34.el10_2, ruby4.0-rubygem-mysql2-0.5.7-34.el10_2 +1
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) ruby4.0-doc-4.0.3-34.el10_2
  • RHSA-2026:18030 Released 2026-05-18 · Red Hat rating Important
    ruby:3.3 security update
    • Red Hat Enterprise Linux AppStream (v. 9) ruby-3.3.10-6.module+el9.7.0+24248+66578cbb.aarch64::ruby:3.3, ruby-3.3.10-6.module+el9.7.0+24248+66578cbb.i686::ruby:3.3, ruby-3.3.10-6.module+el9.7.0+24248+66578cbb.ppc64le::ruby:3.3 +47
  • RHSA-2026:18065 Released 2026-05-18 · Red Hat rating Important
    ruby security update
    • Red Hat Enterprise Linux AppStream (v. 10) ruby-3.3.10-12.el10_1, ruby-bundled-gems-3.3.10-12.el10_1, ruby-default-gems-3.3.10-12.el10_1 +20
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) ruby-doc-3.3.10-12.el10_1
  • RHSA-2026:18039 Released 2026-05-18 · Red Hat rating Important
    ruby security update
    • Red Hat Enterprise Linux AppStream (v. 9) ruby-3.0.7-166.el9_7, ruby-default-gems-3.0.7-166.el9_7, ruby-devel-3.0.7-166.el9_7 +18
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) ruby-doc-3.0.7-166.el9_7

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat CodeReady Linux Builder EUS (v.9.6)Fixed RHSA-2026:33462
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:18065, RHSA-2026:20606
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2026:20614
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:18030, RHSA-2026:18039, RHSA-2026:20596
Red Hat Enterprise Linux AppStream E4S (v.9.0)Fixed RHSA-2026:20670
Red Hat Enterprise Linux AppStream E4S (v.9.2)Fixed RHSA-2026:35834
Red Hat Enterprise Linux AppStream E4S (v.9.4)Fixed RHSA-2026:26312, RHSA-2026:26655
Red Hat Enterprise Linux AppStream EUS (v. 10.0)Fixed RHSA-2026:33478
Red Hat Enterprise Linux AppStream EUS (v.9.6)Fixed RHSA-2026:33462, RHSA-2026:37238
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)Fixed RHSA-2026:18065, RHSA-2026:20606
Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)Fixed RHSA-2026:18039
Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)Fixed RHSA-2026:33478
Not affected: 5 products
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Hardened Images
  • Red Hat OpenShift Container Platform 4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-41316
  2. 2026-10-03 Alias added: GHSA-q339-8rmv-2mhv

References

Advisory 1

Other 3

  • TI-2026-71508 Integer overflow in GitLab allows code execution on the server KEVCVSS 3.1CRITICAL 10.0
  • TI-2026-50176 Use after free in ruby json CVSS 4.0HIGH 8.7
  • TI-2017-12709 Ruby before 2.4.3 allows Net::FTP command injection. CVSS 3.0HIGH 8.8
  • TI-2008-03501 Algorithmic complexity vulnerability in the WEBrick::HTTPUtils.split_header_value… CVSS 2.0HIGH 7.8
  • TI-2021-09891 In Ruby through 3.0 on Windows, a remote attacker can submit a crafted path when a Web… CVSS 3.1HIGH 7.5
  • TI-2025-18855 Net::IMAP vulnerable to possible DoS by memory exhaustion CVSS 3.1MEDIUM 6.5
See all 135 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences