Junglewise Threat Intelligence

CVE-2026-41316: Ruby ERB arbitrary code execution via deserialization guard bypass

CVE-2026-41316 · Severity: high · CVSS 8.1 · Published 2026-04-24

Technologies: Red Hat Enterprise Linux AppStream, Red Hat OpenShift Container Platform 4. Vendors: Red Hat, RubyGems, Ruby.

Executive brief

ERB is a widely used templating system for the Ruby programming language, often found in web frameworks like Ruby on Rails. A security flaw allows an attacker to bypass existing safety measures when the application processes specially crafted, untrusted data. If exploited, this could allow an attacker to remotely execute arbitrary commands on the server, potentially leading to a full system takeover and theft of sensitive data.

Technical details

A vulnerability in ERB's deserialization protection mechanism allows for arbitrary code execution. While ERB implemented an @_init instance variable guard in result() and run() to prevent execution of reconstructed objects via Marshal.load, the def_method, def_module, and def_class methods lack this check. An attacker can provide a malicious payload that uses these methods as a code execution sink. By crafting a @src string that breaks out of the method definition (e.g., using 'end' to close the block early), an attacker can execute arbitrary Ruby code during the module_eval phase. This is particularly effective when combined with gadget chains in libraries like ActiveSupport. Patches are available in ERB versions 4.0.3.1, 4.0.4.1, 6.0.1.1, and 6.0.4.

Affected products

  • Ruby ERB <= 6.0.3
  • Red Hat Enterprise Linux AppStream (v. 8, 9, 10)
  • Red Hat OpenShift Container Platform 4

Timeline

  • 2026-04-21: advisory: GitHub Advisory GHSA-q339-8rmv-2mhv published
  • 2026-04-24: disclosed: CVE-2026-41316 published to NVD
  • 2026-05-18: patched: Red Hat released security updates for RHEL 9 (RHSA-2026:18030)

References

Related threats