CVE-2026-41316

ERB is a templating system for Ruby. Ruby 2.7.0 (before ERB 2.2.0 was published on rubygems.org) introduced an @_init instance variable guard in ERB#result and ERB#run to prevent code execution when an ERB object is reconstructed via Marshal.load (deserialization). However, three other public methods that also evaluate @src via eval() were not given the same guard: ERB#def_method, ERB#def_module, and ERB#def_class. An attacker who can trigger Marshal.load on untrusted data in a Ruby application that has erb loaded can use ERB#def_module (zero-arg, default parameters) as a code execution sink, bypassing the @_init protection entirely. ERB 4.0.3.1, 4.0.4.1, 6.0.1.1, and 6.0.4 patch the issue.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41316.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-693"
    ]
}

References

Affected packages

Git / github.com/ruby/erb

Affected ranges

Type

GIT

Repo

https://github.com/ruby/erb

Events

Introduced

Fixed

b6be29fd0e0f5089447d2f8d18140ae78258621d

Introduced

08b544cdb898b7479f500480bafc1876d19f8bba

Fixed

93450765b5319cfb552a3d9719df137e8fbb75e9

Introduced

8626c822ea8009008fb5884cfc949cbcafbe9680

Fixed

4d2b45e140044f464794c0463d838d5cb4bba96c

Database specific

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "4.0.3.1"
        },
        {
            "last_affected": "= 4.0.4"
        },
        {
            "introduced": "5.0.0"
        },
        {
            "fixed": "6.0.1.1"
        },
        {
            "introduced": "6.0.2"
        },
        {
            "fixed": "6.0.4"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

v2.*

v2.2.0

v2.2.1

v2.2.2

v2.2.3

v3.*

v3.0.0

v4.*

v4.0.0

v4.0.1

v4.0.2

v4.0.3

v5.*

v5.0.0

v5.0.1

v5.0.2

v5.0.3

v5.1.0

v5.1.1

v5.1.2

v5.1.3

v6.*

v6.0.0

v6.0.1

v6.0.3

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-41316.json"