Ruby ERB Deserialization Flaw Allows Code Execution

The National Vulnerability Database has detailed CVE-2026-41316, a critical deserialization vulnerability in ERB, Ruby’s templating system. This flaw allows for remote code execution when an attacker can trigger Marshal.load on untrusted data within a Ruby application that has erb loaded. While Ruby 2.7.0 introduced a guard (@_init) in ERB#result and ERB#run to mitigate such risks, the ERB#def_method, ERB#def_module, and ERB#def_class methods were overlooked.

Specifically, an attacker can leverage ERB#def_module without arguments to bypass the existing @_init protection entirely, executing arbitrary code. This vulnerability carries a CVSS score of 8.1 (HIGH), underscoring its severity. Defenders need to recognize that deserialization vulnerabilities are a persistent, dangerous attack vector.

Patches are available in ERB versions 4.0.3.1, 4.0.4.1, 6.0.1.1, and 6.0.4. Organizations running Ruby applications must prioritize updating their ERB gem to a patched version to prevent exploitation. The attacker’s calculus here is simple: find an application deserializing untrusted input, then exploit the overlooked methods for full system compromise.