| Name | CVE-2026-41316 |
| Description | ERB is a templating system for Ruby. Ruby 2.7.0 (before ERB 2.2.0 was published on rubygems.org) introduced an `@_init` instance variable guard in `ERB#result` and `ERB#run` to prevent code execution when an ERB object is reconstructed via `Marshal.load` (deserialization). However, three other public methods that also evaluate `@src` via `eval()` were not given the same guard: `ERB#def_method`, `ERB#def_module`, and `ERB#def_class`. An attacker who can trigger `Marshal.load` on untrusted data in a Ruby application that has `erb` loaded can use `ERB#def_module` (zero-arg, default parameters) as a code execution sink, bypassing the `@_init` protection entirely. ERB 4.0.3.1, 4.0.4.1, 6.0.1.1, and 6.0.4 patch the issue. |
| Source | CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| Debian Bugs | 1134920 |
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|---|---|---|
| ruby2.7 (PTS) | bullseye | 2.7.4-1+deb11u1 | vulnerable |
| bullseye (security) | 2.7.4-1+deb11u5 | vulnerable | |
| ruby3.1 (PTS) | bookworm, bookworm (security) | 3.1.2-7+deb12u1 | vulnerable |
| ruby3.3 (PTS) | forky, sid, trixie | 3.3.8-2 | vulnerable |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|---|---|---|---|---|---|
| ruby2.7 | source | (unstable) | (unfixed) | |||
| ruby3.1 | source | (unstable) | (unfixed) | |||
| ruby3.3 | source | (unstable) | (unfixed) | 1134920 |
https://github.com/ruby/erb/security/advisories/GHSA-q339-8rmv-2mhv
Fixed by: https://github.com/ruby/erb/commit/9d017be4e375cdd058650ce528ee6adfead20cac (v6.0.4)
Fixed by: https://github.com/ruby/erb/commit/dd34ce41031327269a5fb83b0bc2c0d852895e9f (v6.0.1.1)
Fixed by: https://github.com/ruby/erb/commit/c3b721f7f7570c23e3423590af0419c1b10e1255 (v4.0.4.1)
Fixed by: https://github.com/ruby/erb/commit/ef61b591b270f8ba58d47f12472a1c53a77b4d61 (v4.0.3.1)