CVE-2026-41316
ERB is a templating system for Ruby.
Published Apr 24, 2026 · updated Aug 24, 2026
ERB is a templating system for Ruby. Ruby 2.7.0 (before ERB 2.2.0 was published on rubygems.org) introduced an instance variable guard in and to prevent code execution when an ERB object is reconstructed via (deserialization). However, three other public methods that also evaluate via were not given the same guard: , , and . An attacker who can trigger on untrusted data in a Ruby application that has loaded can use (zero-arg, default parameters) as a code execution sink, bypassing the protection entirely. ERB 4.0.3.1, 4.0.4.1, 6.0.1.1, and 6.0.4 patch the issue.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Apr 24, 2026 · NIST NVD
Detected
ERB is a templating system for Ruby. Ruby 2.7.0 (before ERB 2.2.0 was published on rubygems.org) introduced an instance variable guard in and to prevent code execution when an ERB object is reconstructed via (deserialization). However, three other public methods that also evaluate via were not given the same guard: , , and . An attacker who can trigger on untrusted data in a Ruby application that
Aug 24, 2026 · NIST NVD
Updated
ERB is a templating system for Ruby. Ruby 2.7.0 (before ERB 2.2.0 was published on rubygems.org) introduced an instance variable guard in and to prevent code execution when an ERB object is reconstructed via (deserialization). However, three other public methods that also evaluate via were not given the same guard: , , and . An attacker who can trigger on untrusted data in a Ruby application that
Sources
- CVE.orgVulnerability recordCVE-2026-41316
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-41316
ERB is a templating system for Ruby. Ruby 2.7.0 (before ERB 2.2.0 was published on rubygems.org) introduced an instance variable guard in and to prevent code execution when an ERB object is reconstructed via (deserialization). Howeve
nvd.nist.gov