CVE-2026-41316: Ruby ERB arbitrary code execution via deserialization guard bypass

CVE-2026-41316 · Severity: high · CVSS 8.1 · Published 2026-04-24

ERB is a widely used templating system for the Ruby programming language, often found in web frameworks like Ruby on Rails. A security flaw allows an attacker to bypass existing safety measures when the application processes specially crafted, untrusted data. If exploited, this could allow an attacker to remotely execute arbitrary commands on the server, potentially leading to a full system takeover and theft of sensitive data.

Technologies: Red Hat Enterprise Linux AppStream. Vendors: Red Hat, RubyGems.

Quick answers

Is CVE-2026-41316 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-41316 being exploited in the wild.
How severe is CVE-2026-41316?
High severity, with a CVSS score of 8.1, published 24 April 2026.
Which products and versions are affected?
erb (RubyGems) < 4.0.3.1, = 4.0.4, >= 5.0.0, < 6.0.1.1, >= 6.0.2, < 6.0.4, ECOSYSTEM:introduced=0,fixed=4.0.3.1.
Is there a fix for CVE-2026-41316?
Yes. erb (RubyGems): upgrade to 4.0.3.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-41316 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-41316?
Check whether you run Red Hat Enterprise Linux AppStream or erb (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • erb (RubyGems): upgrade to 4.0.3.1 or later
    bundle update erb

Technical details

A vulnerability in ERB's deserialization protection mechanism allows for arbitrary code execution. While ERB implemented an @_init instance variable guard in result() and run() to prevent execution of reconstructed objects via Marshal.load, the def_method, def_module, and def_class methods lack this check. An attacker can provide a malicious payload that uses these methods as a code execution sink. By crafting a @src string that breaks out of the method definition (e.g., using 'end' to close the block early), an attacker can execute arbitrary Ruby code during the module_eval phase. This is particularly effective when combined with gadget chains in libraries like ActiveSupport. Patches are available in ERB versions 4.0.3.1, 4.0.4.1, 6.0.1.1, and 6.0.4.

Affected products

  • Ruby ERB <= 6.0.3
  • Red Hat Enterprise Linux AppStream (v. 8, 9, 10)
  • Red Hat OpenShift Container Platform 4

Identifiers

  • CVE-2026-41316
  • GHSA-q339-8rmv-2mhv

Timeline

  • 2026-04-21: advisory: GitHub Advisory GHSA-q339-8rmv-2mhv published
  • 2026-04-24: disclosed: CVE-2026-41316 published to NVD
  • 2026-05-18: patched: Red Hat released security updates for RHEL 9 (RHSA-2026:18030)

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.