Skip to main content

Ruby ERB CVE-2026-41316

| EUVDEUVD-2026-25385 HIGH
Protection Mechanism Failure (CWE-693)
2026-04-24 GitHub_M GHSA-q339-8rmv-2mhv
RCE Deserialization Ruby Erb
8.1
CVSS 3.1 · Vendor: GitHub_M
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Identify Marshal.load endpoint
  2. Delivery
    Craft malicious ERB object with code in @src
  3. Exploit
    Serialize payload via Marshal.dump
  4. Execution
    Inject into deserialization path (API/queue)
  5. Persist
    Trigger def_module() during object reconstruction
  6. Impact
    Execute arbitrary Ruby code with application privileges

Vulnerability Assessment

Weakness
CWE
CWE-693
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V15 - Secure Coding and Architecture Protection mechanism completeness
Exploitation Conditions

Exploitation requires Ruby applications that: 1) have the ERB library loaded in the runtime environment (common as ERB is part of Ruby stdlib), AND 2) call Marshal.load or Marshal.restore on data controllable by external attackers, AND 3) the deserialized ERB object must trigger one of the unguarded methods - def_module() being most practical as it requires zero arguments with default parameters. This is NOT a default-configuration vulnerability. Exploitation is limited to applications with unsafe deserialization patterns, typically legacy codebases, background job systems with insufficient input validation (Sidekiq/Resque/DelayedJob misconfigured to accept external payloads), or Rails applications using Marshal-based session stores exposed to tampering. Modern Rails apps using signed/encrypted cookies or JSON-based serialization are not vulnerable through default configurations. The AC:H complexity rating reflects these prerequisites: the vulnerability exists but requires specific architectural anti-patterns to be exploitable.
Impact

CVSS 8.1 (High) reflects severe impact (arbitrary code execution with full system access) but high attack complexity. The AC:H rating is critical: exploitation requires the application to deserialize untrusted Marshal data while ERB is loaded, a pattern discouraged but still present in legacy Ruby applications, background job processors (Sidekiq, Resque if misconfigured), or Rails caching layers. The PR:N/UI:N vector means no authentication or user interaction is needed if the deserialization endpoint is exposed. Without EPSS or KEV data, real-world exploitation risk is difficult to quantify, but the narrow attack surface (unsafe Marshal.load is a known anti-pattern) suggests targeted rather than widespread exploitation. Priority depends heavily on whether your Ruby applications accept serialized data from untrusted sources. SSVC assessment: exploitation status unknown, automatable if deserialization endpoints exist, technical impact total (code execution), human impact likely varies by deployment context. This is a defense-in-depth failure requiring specific vulnerable code paths, not a universal remote exploit.
Exploit ScenarioDerived

An attacker identifies a Rails application using Sidekiq for background job processing that deserializes job arguments via Marshal.load from a Redis queue accepting external API inputs. The attacker crafts a malicious ERB object with arbitrary Ruby code embedded in the @src variable and serializes it using Marshal.dump. By injecting this payload into the job queue (via API manipulation or compromised authentication), the attacker triggers deserialization when Sidekiq workers process the job. The worker calls ERB#def_module on the reconstructed object, bypassing the @_init guard and executing the attacker's code with worker process privileges, potentially installing a web shell or exfiltrating environment credentials.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Apr 24, 2026

Remote code execution in Ruby ERB library via unsafe deserialization allows unauthenticated attackers to execute arbitrary code by exploiting incomplete protection in Marshal.load workflows. While ERB 2.2.0+ added guards to prevent code execution during deserialization in result() and run() methods, the def_module(), def_method(), and def_class() methods remained unprotected, enabling attackers to bypass the @_init safeguard. Exploitation requires high complexity (AV:N/AC:H) as applications must deserialize untrusted Marshal data with ERB loaded. No EPSS or KEV data available; exploitation likelihood depends on prevalence of unsafe Marshal.load patterns in Ruby codebases.

RemediationAI

Upgrade ERB to patched versions: 4.0.3.1, 4.0.4.1, 6.0.1.1, or 6.0.4 as detailed in GitHub advisory GHSA-q339-8rmv-2mhv (https://github.com/ruby/erb/security/advisories/GHSA-q339-8rmv-2mhv). For Ruby core distributions, ensure your Ruby version includes the patched ERB library or explicitly update the erb gem via bundler. If immediate patching is not feasible, implement compensating controls: 1) Eliminate all use of Marshal.load on untrusted data - replace with safe serialization formats like JSON or MessagePack with strict schema validation; 2) If Marshal.load is unavoidable, implement strict allowlist-based deserialization using safe_load alternatives or custom wrapper classes that validate object types before reconstruction; 3) Apply network segmentation to isolate services performing deserialization from untrusted sources. Note that these workarounds add development complexity and may break legacy functionality relying on Marshal serialization. Audit codebases for Marshal.load patterns in background job handlers, session stores, and caching layers as priority remediation targets.

Affected VersionsENISA

erb 5.0.0, < 6.0.1.1
erb 6.0.2, < 6.0.4
erb = 4.0.4
erb < 4.0.3.1

Affected Packages

rubygems erb fix: 4.0.3.1, 4.0.4.1, 6.0.1.1, 6.0.4

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in rubygems

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

ERB (Embedded RuBy) is the standard templating engine for Ruby, bundled with Ruby core and available as a standalone gem. The vulnerability stems from incomplete deserialization protection (CWE-693: Protection Mechanism Failure). Ruby's Marshal.load reconstructs objects from serialized data, but when an ERB object is deserialized, it can trigger code evaluation through the @src instance variable. Ruby 2.7.0 introduced an @_init guard in ERB#result and ERB#run to prevent this, but three additional public methods (def_method, def_module, def_class) that also call eval(@src) were left unguarded. An attacker crafting a malicious ERB object can trigger def_module() with zero arguments and default parameters, executing arbitrary Ruby code server-side. This represents a classic protection bypass where security controls were applied inconsistently across similar attack surfaces within the same component.

Know when Erb gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (GitHub_M) PRIMARY 8.1 HIGH
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
SUSE HIGH
Red Hat 8.1 HIGH

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

3
Patch released
Apr 29, 2026 - 20:56 nvd
Patch available
Patch available
Apr 24, 2026 - 05:31 EUVD
CVE Published
Apr 24, 2026 - 02:35 nvd
HIGH 8.1

DescriptionCVE.org

ERB is a templating system for Ruby. Ruby 2.7.0 (before ERB 2.2.0 was published on rubygems.org) introduced an @_init instance variable guard in ERB#result and ERB#run to prevent code execution when an ERB object is reconstructed via Marshal.load (deserialization). However, three other public methods that also evaluate @src via eval() were not given the same guard: ERB#def_method, ERB#def_module, and ERB#def_class. An attacker who can trigger Marshal.load on untrusted data in a Ruby application that has erb loaded can use ERB#def_module (zero-arg, default parameters) as a code execution sink, bypassing the @_init protection entirely. ERB 4.0.3.1, 4.0.4.1, 6.0.1.1, and 6.0.4 patch the issue.

Executive ViewAI

Why It Matters

CVE-2026-41316 is a high-severity remote code execution vulnerability in Ruby's ERB library affecting applications that deserialize untrusted data through specific ERB methods (def_module, def_method, def_class), despite partial protections in ERB 2.2.0+. Organizations using Ruby applications that process untrusted serialized data face potential complete system compromise, requiring immediate inventory of affected code patterns and urgent remediation planning.

Business Impact: High
Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: (1) Disable or restrict access to ERB def_module(), def_method(), and def_class() methods in production; (2) Implement strict input validation to reject serialized Marshal data from untrusted sources; (3) Use permitted_classes parameter in any remaining Marshal.load calls to whitelist only safe classes; (4) Isolate affected Ruby applications on segmented networks; (5) Disable ERB library entirely if not required for core functionality; (6) Monitor application logs for suspicious deserialization patterns.

Threat Intelligence Overview

EPSS Score
0.1%
Top 76% exploitable
Threat Intel
1
1 source
Social Media
2
Sightings
Data Quality
8 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment GHSA Vendor CIRCL GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.1%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
No
Human Impact
High
Technical Impact
Total

Priority Score

40
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +40
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Insecure Deserialization CRITICAL

Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.

Remote Code Execution CRITICAL

Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.

Same weakness CWE-693 – Protection Mechanism Failure

View all
CVE-2013-2465 CRITICAL POC
9.8
CVE-2024-21412 HIGH POC
8.1
CVE-2019-1003030 CRITICAL POC
9.9
CVE-2013-0431 LOW POC
3.7
CVE-2025-40536 HIGH POC
8.1
CVE-2024-38217 MEDIUM POC
5.4
CVE-2026-21513 HIGH
8.8
CVE-2026-21510 HIGH POC
8.8

Same technique RCE

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2017-7269 CRITICAL POC
9.8
CVE-2022-47966 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2023-3519 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-41316 ADVISORY https://vuldb.com/vuln/359267 REF https://access.redhat.com/errata/RHSA-2026:18030 REF https://access.redhat.com/errata/RHSA-2026:18039 REF https://access.redhat.com/errata/RHSA-2026:18065 REF https://access.redhat.com/errata/RHSA-2026:20596 REF https://access.redhat.com/errata/RHSA-2026:20606 REF https://access.redhat.com/errata/RHSA-2026:20614 REF https://access.redhat.com/errata/RHSA-2026:20670 REF https://access.redhat.com/errata/RHSA-2026:26312 REF https://access.redhat.com/errata/RHSA-2026:26655 REF https://access.redhat.com/errata/RHSA-2026:33462 REF https://access.redhat.com/errata/RHSA-2026:33478 REF https://access.redhat.com/errata/RHSA-2026:35834 REF https://access.redhat.com/errata/RHSA-2026:37238 REF https://access.redhat.com/security/cve/CVE-2026-41316 REF https://bugzilla.redhat.com/show_bug.cgi?id=2461369 REF https://github.com/ruby/erb/security/advisories/GHSA-q339-8rmv-2mhv REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41316.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy