Ruby ERB CVE-2026-41316

Upgrade ERB to patched versions: 4.0.3.1, 4.0.4.1, 6.0.1.1, or 6.0.4 as detailed in GitHub advisory GHSA-q339-8rmv-2mhv (https://github.com/ruby/erb/security/advisories/GHSA-q339-8rmv-2mhv). For Ruby core distributions, ensure your Ruby version includes the patched ERB library or explicitly update the erb gem via bundler. If immediate patching is not feasible, implement compensating controls: 1) Eliminate all use of Marshal.load on untrusted data - replace with safe serialization formats like JSON or MessagePack with strict schema validation; 2) If Marshal.load is unavoidable, implement strict allowlist-based deserialization using safe_load alternatives or custom wrapper classes that validate object types before reconstruction; 3) Apply network segmentation to isolate services performing deserialization from untrusted sources. Note that these workarounds add development complexity and may break legacy functionality relying on Marshal serialization. Audit codebases for Marshal.load patterns in background job handlers, session stores, and caching layers as priority remediation targets.