CVE-2026-41316 - Vulnerability Analysis

Overview

Ruby ERB before 4.0.3.1, 4.0.4.1, 6.0.1.1, and 6.0.4 contains a remote code execution caused by missing instance variable guard in ERB#def_module during deserialization, letting attackers execute arbitrary code via Marshal.load on untrusted data, exploit requires ability to trigger Marshal.load on untrusted data.

Severity & Score

Impact

Attackers can execute arbitrary code remotely by exploiting deserialization in ERB, potentially leading to full system compromise.

Mitigation

Update to ERB versions 4.0.3.1, 4.0.4.1, 6.0.1.1, 6.0.4 or later.

References

• https://github.com/ruby/erb/security/advisories/GHSA-q339-8rmv-2mhv

Social Media Activity(1 post)

Fernando Briano

@picandocodigo

Apr 21, 2026

Ruby 4.0.3 Released This release only contains ERB 6.0.1.1, which fixes CVE-2026-41316. https://www.ruby-lang.org/en/news/2026/04/21/ruby-4-0-3-released/ #Ruby

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner