CVE-2026-41316 ERB has an @_init deserialization guard bypass via def_module / def_method / def_class
Attackers can bypass deserialization guards in the Ruby ERB library to execute arbitrary code via specific public methods.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-41316?
CVE-2026-41316 is a high-severity unsafe deserialization vulnerability in ruby erb, published on 24 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
ERB is a templating system for Ruby. Ruby 2.7.0 (before ERB 2.2.0 was published on rubygems.org) introduced an `@_init` instance variable guard in `ERB#result` and `ERB#run` to prevent code execution when an ERB object is reconstructed via `Marshal.load` (deserialization). However, three other public methods that also evaluate `@src` via `eval()` were not given the same guard: `ERB#def_method`, `ERB#def_module`, and `ERB#def_class`. An attacker who can trigger `Marshal.load` on untrusted data in a Ruby application that has `erb` loaded can use `ERB#def_module` (zero-arg, default parameters) as a code execution sink, bypassing the `@_init` protection entirely. ERB 4.0.3.1, 4.0.4.1, 6.0.1.1, and 6.0.4 patch the issue.
Which versions are affected by CVE-2026-41316?
8 open source packages ship an affected version, including erb.
| Package | Affected | Fixed in |
|---|---|---|
erb RubyGems | All versions | 4.0.3.1 |
erb RubyGems | All versions | 4.0.3.1 |
erb RubyGems | From 4.0.4 | 4.0.4.1 |
erb RubyGems | From 4.0.4 | 4.0.4.1 |
erb RubyGems | From 5.0.0 | 6.0.1.1 |
erb RubyGems | From 5.0.0 | 6.0.1.1 |
2 more packages
erb RubyGems | From 6.0.2 | 6.0.4 |
erb RubyGems | From 6.0.2 | 6.0.4 |
Linux distribution packages (32)
ruby-default-gems AlmaLinux:10 | All versions | 3.3.10-12.el10_1 |
ruby-doc AlmaLinux:10 | All versions | 3.3.10-12.el10_1 |
rubygem-bundler AlmaLinux:10 | All versions | 2.5.22-12.el10_1 |
rubygem-irb AlmaLinux:10 | All versions | 1.13.1-12.el10_1 |
rubygem-minitest AlmaLinux:10 | All versions | 5.20.0-12.el10_1 |
rubygem-power_assert AlmaLinux:10 | All versions | 2.0.3-12.el10_1 |
rubygem-rake AlmaLinux:10 | All versions | 13.1.0-12.el10_1 |
rubygem-rdoc AlmaLinux:10 | All versions | 6.6.3.1-12.el10_1 |
rubygem-rexml AlmaLinux:10 | All versions | 3.4.4-12.el10_1 |
rubygem-rss AlmaLinux:10 | All versions | 0.3.1-12.el10_1 |
rubygem-test-unit AlmaLinux:10 | All versions | 3.6.1-12.el10_1 |
rubygem-typeprof AlmaLinux:10 | All versions | 0.21.9-12.el10_1 |
rubygems AlmaLinux:10 | All versions | 3.5.22-12.el10_1 |
rubygems-devel AlmaLinux:10 | All versions | 3.5.22-12.el10_1 |
ruby AlmaLinux:8 | All versions | 3.3.10-6.module_el8.10.0+4183+69a3c42f |
ruby-bundled-gems AlmaLinux:8 | All versions | 3.3.10-6.module_el8.10.0+4183+69a3c42f |
ruby-default-gems AlmaLinux:8 | All versions | 3.3.10-6.module_el8.10.0+4183+69a3c42f |
ruby-devel AlmaLinux:8 | All versions | 3.3.10-6.module_el8.10.0+4183+69a3c42f |
ruby-doc AlmaLinux:8 | All versions | 3.3.10-6.module_el8.10.0+4183+69a3c42f |
ruby-libs AlmaLinux:8 | All versions | 3.3.10-6.module_el8.10.0+4183+69a3c42f |
rubygem-abrt AlmaLinux:8 | All versions | 0.4.0-1.module_el8.10.0+3799+191214cc |
rubygem-abrt-doc AlmaLinux:8 | All versions | 0.4.0-1.module_el8.10.0+3799+191214cc |
rubygem-bigdecimal AlmaLinux:8 | All versions | 3.1.5-6.module_el8.10.0+4183+69a3c42f |
rubygem-bundler AlmaLinux:8 | All versions | 2.5.22-6.module_el8.10.0+4183+69a3c42f |
rubygem-io-console AlmaLinux:8 | All versions | 0.7.1-6.module_el8.10.0+4183+69a3c42f |
rubygem-irb AlmaLinux:8 | All versions | 1.13.1-6.module_el8.10.0+4183+69a3c42f |
rubygem-json AlmaLinux:8 | All versions | 2.7.2-6.module_el8.10.0+4183+69a3c42f |
rubygem-minitest AlmaLinux:8 | All versions | 5.20.0-6.module_el8.10.0+4183+69a3c42f |
rubygem-mysql2 AlmaLinux:8 | All versions | 0.5.5-1.module_el8.10.0+3799+191214cc |
rubygem-mysql2-doc AlmaLinux:8 | All versions | 0.5.5-1.module_el8.10.0+3799+191214cc |
rubygem-pg AlmaLinux:8 | All versions | 1.5.4-1.module_el8.10.0+3799+191214cc |
rubygem-pg-doc AlmaLinux:8 | All versions | 1.5.4-1.module_el8.10.0+3799+191214cc |
How do I fix CVE-2026-41316?
Upgrade erb to a fixed version for your release line: 4.0.3.1, 4.0.4.1, 6.0.1.1 or 6.0.4.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2026-41316 being exploited?
There is no known exploitation of CVE-2026-41316 in the wild and no public exploit code.
Sources
Also known as ALPINE-CVE-2026-41316, ALSA-2026:18030, ALSA-2026:18039, ALSA-2026:18065, ALSA-2026:20614, BELL-CVE-2026-41316 and 42 more.