CVE-2026-41316
1 advisory.
RubyGems/erb CVE-2026-41316: high 8.1
ERB has an @_init deserialization guard bypass via def_module / def_method / def_class
Action: Upgrade erb to 4.0.3.1 or later.
bundle update erbAffected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 4.0.3.1 | - |
| 4.0.4 | 4.0.4.1 | - |
| 5.0.0 | 6.0.1.1 | - |
| 6.0.2 | 6.0.4 | - |
Fixed versions
| 4.0.3.1 | 4.0.4.1 | 6.0.1.1 | 6.0.4 |
Sources
- osv: GHSA-q339-8rmv-2mhv
- https://github.com/ruby/erb/security/advisories/GHSA-q339-8rmv-2mhv
- https://nvd.nist.gov/vuln/detail/CVE-2026-41316
- https://github.com/ruby/erb
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/erb/CVE-2026-41316.yml
CVE-2026-41316 · published · modified · JSON