ruby erb up to 4.0.4/6.0.3 eval protection mechanism

Summaryinfo

A vulnerability classified as problematic has been found in ruby erb up to 4.0.4/6.0.3. The impacted element is the function eval. The manipulation leads to protection mechanism. This vulnerability is uniquely identified as CVE-2026-41316. The attack is possible to be carried out remotely. No exploit exists. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in ruby erb up to 4.0.4/6.0.3 and classified as problematic. This issue affects the function eval. The manipulation with an unknown input leads to a protection mechanism vulnerability. Using CWE to declare the problem leads to CWE-693. The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

ERB is a templating system for Ruby. Ruby 2.7.0 (before ERB 2.2.0 was published on rubygems.org) introduced an `@_init` instance variable guard in `ERB#result` and `ERB#run` to prevent code execution when an ERB object is reconstructed via `Marshal.load` (deserialization). However, three other public methods that also evaluate `@src` via `eval()` were not given the same guard: `ERB#def_method`, `ERB#def_module`, and `ERB#def_class`. An attacker who can trigger `Marshal.load` on untrusted data in a Ruby application that has `erb` loaded can use `ERB#def_module` (zero-arg, default parameters) as a code execution sink, bypassing the `@_init` protection entirely. ERB 4.0.3.1, 4.0.4.1, 6.0.1.1, and 6.0.4 patch the issue.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-41316 since 04/20/2026. The exploitation is known to be difficult. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details of the vulnerability are known, but there is no available exploit.

The vulnerability scanner Nessus provides a plugin with the ID 314590 (Amazon Linux 2 : ruby, --advisory ALAS2-2026-3284 (ALAS-2026-3284)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 4.0.3.1, 6.0.1.1 or 6.0.4 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (314590), EUVD (EUVD-2026-25385) and CERT Bund (WID-SEC-2026-1187). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Affected

• Red Hat Enterprise Linux
• Oracle Linux
• RESF Rocky Linux
• Open Source Ruby
• Open Source Ruby on Rails
• Amazon Linux 2

Productinfo

Type

• Programming Language Software

Vendor

• ruby

Name

• erb

Version

• 4.0.0
• 4.0.1
• 4.0.2
• 4.0.3
• 4.0.4
• 6.0.0
• 6.0.1
• 6.0.2
• 6.0.3

License

• open-source

Website

• Product: https://github.com/ruby/erb/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion