CVE-2026-41316

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-41316", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-20T14:01:46.671Z", "datePublished": "2026-04-24T02:35:41.160Z", "dateUpdated": "2026-08-24T12:06:46.132Z"}, "containers": {"cna": {"title": "ERB has an @_init deserialization guard bypass via def_module / def_method / def_class", "problemTypes": [{"descriptions": [{"cweId": "CWE-693", "lang": "en", "description": "CWE-693: Protection Mechanism Failure", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/ruby/erb/security/advisories/GHSA-q339-8rmv-2mhv", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/ruby/erb/security/advisories/GHSA-q339-8rmv-2mhv"}], "affected": [{"vendor": "ruby", "product": "erb", "versions": [{"version": "< 4.0.3.1", "status": "affected"}, {"version": "= 4.0.4", "status": "affected"}, {"version": ">= 5.0.0, < 6.0.1.1", "status": "affected"}, {"version": ">= 6.0.2, < 6.0.4", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-24T02:35:41.160Z"}, "descriptions": [{"lang": "en", "value": "ERB is a templating system for Ruby. Ruby 2.7.0 (before ERB 2.2.0 was published on rubygems.org) introduced an `@_init` instance variable guard in `ERB#result` and `ERB#run` to prevent code execution when an ERB object is reconstructed via `Marshal.load` (deserialization). However, three other public methods that also evaluate `@src` via `eval()` were not given the same guard: `ERB#def_method`, `ERB#def_module`, and `ERB#def_class`. An attacker who can trigger `Marshal.load` on untrusted data in a Ruby application that has `erb` loaded can use `ERB#def_module` (zero-arg, default parameters) as a code execution sink, bypassing the `@_init` protection entirely. ERB 4.0.3.1, 4.0.4.1, 6.0.1.1, and 6.0.4 patch the issue."}], "source": {"advisory": "GHSA-q339-8rmv-2mhv", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-25T01:45:02.467085Z", "id": "CVE-2026-41316", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-25T01:45:43.173Z"}}, {"affected": [{"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:10.1"], "defaultStatus": "affected", "packageName": "ruby", "product": "Red Hat Enterprise Linux 10", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:3.3.10-12.el10_1", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:10.2"], "defaultStatus": "affected", "packageName": "ruby4.0", "product": "Red Hat Enterprise Linux 10", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:4.0.3-34.el10_2", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux_eus:10.0"], "defaultStatus": "affected", "packageName": "ruby", "product": "Red Hat Enterprise Linux 10.0 Extended Update Support", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:3.3.10-11.el10_0.1", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:enterprise_linux:8"], "defaultStatus": "affected", "packageName": "ruby:3.3", "product": "Red Hat Enterprise Linux 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "8100020260428163940.489197e6", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux:9"], "defaultStatus": "affected", "packageName": "ruby:3.3", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "9070020260428163621.9", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux:9"], "defaultStatus": "affected", "packageName": "ruby", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:3.0.7-166.el9_7", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux:9"], "defaultStatus": "affected", "packageName": "ruby:4.0", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "9080020260513131334.9", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_e4s:9.0"], "defaultStatus": "affected", "packageName": "ruby", "product": "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:3.0.4-160.2.el9_0", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_e4s:9.2"], "defaultStatus": "affected", "packageName": "ruby", "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:3.0.4-161.el9_2.3", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_e4s:9.4"], "defaultStatus": "affected", "packageName": "ruby", "product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:3.0.7-162.el9_4.2", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_e4s:9.4"], "defaultStatus": "affected", "packageName": "ruby:3.3", "product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "9040020260520083544.9", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_eus:9.6"], "defaultStatus": "affected", "packageName": "ruby", "product": "Red Hat Enterprise Linux 9.6 Extended Update Support", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:3.0.7-165.el9_6.1", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_eus:9.6"], "defaultStatus": "affected", "packageName": "ruby:3.3", "product": "Red Hat Enterprise Linux 9.6 Extended Update Support", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "9060020260630075016.9", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:6"], "defaultStatus": "unaffected", "packageName": "ruby", "product": "Red Hat Enterprise Linux 6", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:7"], "defaultStatus": "unaffected", "packageName": "ruby", "product": "Red Hat Enterprise Linux 7", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:8"], "defaultStatus": "unaffected", "packageName": "ruby:2.5/ruby", "product": "Red Hat Enterprise Linux 8", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:hummingbird:1"], "defaultStatus": "unaffected", "packageName": "ruby3.3", "product": "Red Hat Hardened Images", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:hummingbird:1"], "defaultStatus": "unaffected", "packageName": "ruby3.4", "product": "Red Hat Hardened Images", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:hummingbird:1"], "defaultStatus": "unaffected", "packageName": "ruby4.0", "product": "Red Hat Hardened Images", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift:4"], "defaultStatus": "unaffected", "packageName": "openshift/ose-rhel-coreos-9", "product": "Red Hat OpenShift Container Platform 4", "vendor": "Red Hat"}], "datePublic": "2026-04-24T02:35:41.160Z", "descriptions": [{"lang": "en", "value": "A flaw was found in ERB, a templating system for Ruby. An attacker who can trigger deserialization of untrusted data in a Ruby application can bypass existing protections. This vulnerability allows for arbitrary code execution by exploiting specific public methods that evaluate template source code, which were not properly guarded against deserialization attacks."}], "metrics": [{"other": {"content": {"namespace": "https://access.redhat.com/security/updates/classification/", "value": "Important"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS"}], "problemTypes": [{"descriptions": [{"cweId": "CWE-502", "description": "Deserialization of Untrusted Data", "lang": "en", "type": "CWE"}]}], "references": [{"tags": ["vdb-entry", "x_refsource_REDHAT"], "url": "https://access.redhat.com/security/cve/CVE-2026-41316"}, {"name": "RHBZ#2461369", "tags": ["issue-tracking", "x_refsource_REDHAT"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461369"}, {"tags": ["x_sadp-csaf-vex"], "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41316.json"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:33478"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:18065"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:20606"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:20614"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:20670"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:35834"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:26312"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:26655"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:33462"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:37238"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:18039"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:18030"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:20596"}], "solutions": [{"lang": "en", "value": "RHSA-2026:33478: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)"}, {"lang": "en", "value": "RHSA-2026:18065: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)"}, {"lang": "en", "value": "RHSA-2026:20606: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)"}, {"lang": "en", "value": "RHSA-2026:20614: Red Hat Enterprise Linux AppStream (v. 8)"}, {"lang": "en", "value": "RHSA-2026:20670: Red Hat Enterprise Linux AppStream E4S (v.9.0)"}, {"lang": "en", "value": "RHSA-2026:35834: Red Hat Enterprise Linux AppStream E4S (v.9.2)"}, {"lang": "en", "value": "RHSA-2026:26312: Red Hat Enterprise Linux AppStream E4S (v.9.4)"}, {"lang": "en", "value": "RHSA-2026:26655: Red Hat Enterprise Linux AppStream E4S (v.9.4)"}, {"lang": "en", "value": "RHSA-2026:33462: Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux AppStream EUS (v.9.6)"}, {"lang": "en", "value": "RHSA-2026:37238: Red Hat Enterprise Linux AppStream EUS (v.9.6)"}, {"lang": "en", "value": "RHSA-2026:18039: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)"}, {"lang": "en", "value": "RHSA-2026:18030: Red Hat Enterprise Linux AppStream (v. 9)"}, {"lang": "en", "value": "RHSA-2026:20596: Red Hat Enterprise Linux AppStream (v. 9)"}], "timeline": [{"lang": "en", "time": "2026-04-24T03:01:16.620Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-04-24T02:35:41.160Z", "value": "Made public."}], "title": "erb: ERB: Arbitrary code execution via deserialization bypass", "x_adpType": "supplier", "x_generator": {"engine": "sadp-cli 1.0.0"}, "providerMetadata": {"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "shortName": "redhat-SADP", "dateUpdated": "2026-08-24T12:06:46.132Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "erb: ERB: Arbitrary code execution via deserialization bypass", "metrics": [{"other": {"type": "Red Hat severity rating", "content": {"value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/"}}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"cpes": ["cpe:/o:redhat:enterprise_linux:10.1"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "versions": [{"status": "unaffected", "version": "0:3.3.10-12.el10_1", "lessThan": "*", "versionType": "rpm"}], "packageName": "ruby", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:10.2"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "versions": [{"status": "unaffected", "version": "0:4.0.3-34.el10_2", "lessThan": "*", "versionType": "rpm"}], "packageName": "ruby4.0", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux_eus:10.0"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10.0 Extended Update Support", "versions": [{"status": "unaffected", "version": "0:3.3.10-11.el10_0.1", "lessThan": "*", "versionType": "rpm"}], "packageName": "ruby", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:enterprise_linux:8"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8", "versions": [{"status": "unaffected", "version": "8100020260428163940.489197e6", "lessThan": "*", "versionType": "rpm"}], "packageName": "ruby:3.3", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:enterprise_linux:9"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9", "versions": [{"status": "unaffected", "version": "9070020260428163621.9", "lessThan": "*", "versionType": "rpm"}], "packageName": "ruby:3.3", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:enterprise_linux:9"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9", "versions": [{"status": "unaffected", "version": "0:3.0.7-166.el9_7", "lessThan": "*", "versionType": "rpm"}], "packageName": "ruby", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:enterprise_linux:9"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9", "versions": [{"status": "unaffected", "version": "9080020260513131334.9", "lessThan": "*", "versionType": "rpm"}], "packageName": "ruby:4.0", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:rhel_e4s:9.0"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions", "versions": [{"status": "unaffected", "version": "0:3.0.4-160.2.el9_0", "lessThan": "*", "versionType": "rpm"}], "packageName": "ruby", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:rhel_e4s:9.2"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions", "versions": [{"status": "unaffected", "version": "0:3.0.4-161.el9_2.3", "lessThan": "*", "versionType": "rpm"}], "packageName": "ruby", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:rhel_e4s:9.4"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions", "versions": [{"status": "unaffected", "version": "0:3.0.7-162.el9_4.2", "lessThan": "*", "versionType": "rpm"}], "packageName": "ruby", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:rhel_e4s:9.4"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions", "versions": [{"status": "unaffected", "version": "9040020260520083544.9", "lessThan": "*", "versionType": "rpm"}], "packageName": "ruby:3.3", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:rhel_eus:9.6"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9.6 Extended Update Support", "versions": [{"status": "unaffected", "version": "0:3.0.7-165.el9_6.1", "lessThan": "*", "versionType": "rpm"}], "packageName": "ruby", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:rhel_eus:9.6"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9.6 Extended Update Support", "versions": [{"status": "unaffected", "version": "9060020260630075016.9", "lessThan": "*", "versionType": "rpm"}], "packageName": "ruby:3.3", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:6"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 6", "packageName": "ruby", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:7"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 7", "packageName": "ruby", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:8"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8", "packageName": "ruby:2.5/ruby", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:hummingbird:1"], "vendor": "Red Hat", "product": "Red Hat Hardened Images", "packageName": "ruby3.3", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:hummingbird:1"], "vendor": "Red Hat", "product": "Red Hat Hardened Images", "packageName": "ruby3.4", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:hummingbird:1"], "vendor": "Red Hat", "product": "Red Hat Hardened Images", "packageName": "ruby4.0", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:openshift:4"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4", "packageName": "openshift/ose-rhel-coreos-9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-04-24T03:01:16.620Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-04-24T02:35:41.160Z", "value": "Made public."}], "solutions": [{"lang": "en", "value": "RHSA-2026:33478: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)"}, {"lang": "en", "value": "RHSA-2026:18065: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)"}, {"lang": "en", "value": "RHSA-2026:20606: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)"}, {"lang": "en", "value": "RHSA-2026:20614: Red Hat Enterprise Linux AppStream (v. 8)"}, {"lang": "en", "value": "RHSA-2026:20670: Red Hat Enterprise Linux AppStream E4S (v.9.0)"}, {"lang": "en", "value": "RHSA-2026:35834: Red Hat Enterprise Linux AppStream E4S (v.9.2)"}, {"lang": "en", "value": "RHSA-2026:26312: Red Hat Enterprise Linux AppStream E4S (v.9.4)"}, {"lang": "en", "value": "RHSA-2026:26655: Red Hat Enterprise Linux AppStream E4S (v.9.4)"}, {"lang": "en", "value": "RHSA-2026:33462: Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux AppStream EUS (v.9.6)"}, {"lang": "en", "value": "RHSA-2026:37238: Red Hat Enterprise Linux AppStream EUS (v.9.6)"}, {"lang": "en", "value": "RHSA-2026:18039: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)"}, {"lang": "en", "value": "RHSA-2026:18030: Red Hat Enterprise Linux AppStream (v. 9)"}, {"lang": "en", "value": "RHSA-2026:20596: Red Hat Enterprise Linux AppStream (v. 9)"}], "x_adpType": "supplier", "datePublic": "2026-04-24T02:35:41.160Z", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-41316", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461369", "name": "RHBZ#2461369", "tags": ["issue-tracking", "x_refsource_REDHAT"]}, {"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41316.json", "tags": ["x_sadp-csaf-vex"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:33478", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:18065", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:20606", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:20614", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:20670", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:35834", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:26312", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:26655", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:33462", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:37238", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:18039", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:18030", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:20596", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}], "x_generator": {"engine": "sadp-cli 1.0.0"}, "descriptions": [{"lang": "en", "value": "A flaw was found in ERB, a templating system for Ruby. An attacker who can trigger deserialization of untrusted data in a Ruby application can bypass existing protections. This vulnerability allows for arbitrary code execution by exploiting specific public methods that evaluate template source code, which were not properly guarded against deserialization attacks."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-502", "description": "Deserialization of Untrusted Data"}]}], "providerMetadata": {"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "shortName": "redhat-SADP", "dateUpdated": "2026-08-24T12:06:46.132Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-41316", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-25T01:45:02.467085Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-25T01:45:39.369Z"}}], "cna": {"title": "ERB has an @_init deserialization guard bypass via def_module / def_method / def_class", "source": {"advisory": "GHSA-q339-8rmv-2mhv", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "ruby", "product": "erb", "versions": [{"status": "affected", "version": "< 4.0.3.1"}, {"status": "affected", "version": "= 4.0.4"}, {"status": "affected", "version": ">= 5.0.0, < 6.0.1.1"}, {"status": "affected", "version": ">= 6.0.2, < 6.0.4"}]}], "references": [{"url": "https://github.com/ruby/erb/security/advisories/GHSA-q339-8rmv-2mhv", "name": "https://github.com/ruby/erb/security/advisories/GHSA-q339-8rmv-2mhv", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "ERB is a templating system for Ruby. Ruby 2.7.0 (before ERB 2.2.0 was published on rubygems.org) introduced an `@_init` instance variable guard in `ERB#result` and `ERB#run` to prevent code execution when an ERB object is reconstructed via `Marshal.load` (deserialization). However, three other public methods that also evaluate `@src` via `eval()` were not given the same guard: `ERB#def_method`, `ERB#def_module`, and `ERB#def_class`. An attacker who can trigger `Marshal.load` on untrusted data in a Ruby application that has `erb` loaded can use `ERB#def_module` (zero-arg, default parameters) as a code execution sink, bypassing the `@_init` protection entirely. ERB 4.0.3.1, 4.0.4.1, 6.0.1.1, and 6.0.4 patch the issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-693", "description": "CWE-693: Protection Mechanism Failure"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-24T02:35:41.160Z"}}}, "cveMetadata": {"cveId": "CVE-2026-41316", "state": "PUBLISHED", "dateUpdated": "2026-08-24T12:06:46.132Z", "dateReserved": "2026-04-20T14:01:46.671Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-24T02:35:41.160Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "erb", "vendor": "ruby", "versions": [{"status": "affected", "version": "< 4.0.3.1"}, {"status": "affected", "version": "= 4.0.4"}, {"status": "affected", "version": ">= 5.0.0, < 6.0.1.1"}, {"status": "affected", "version": ">= 6.0.2, < 6.0.4"}]}], "source": "security-advisories@github.com"}, {"affectedData": [{"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:10.1"], "defaultStatus": "affected", "packageName": "ruby", "product": "Red Hat Enterprise Linux 10", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:3.3.10-12.el10_1", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:10.2"], "defaultStatus": "affected", "packageName": "ruby4.0", "product": "Red Hat Enterprise Linux 10", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:4.0.3-34.el10_2", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux_eus:10.0"], "defaultStatus": "affected", "packageName": "ruby", "product": "Red Hat Enterprise Linux 10.0 Extended Update Support", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:3.3.10-11.el10_0.1", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:enterprise_linux:8"], "defaultStatus": "affected", "packageName": "ruby:3.3", "product": "Red Hat Enterprise Linux 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "8100020260428163940.489197e6", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux:9"], "defaultStatus": "affected", "packageName": "ruby:3.3", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "9070020260428163621.9", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux:9"], "defaultStatus": "affected", "packageName": "ruby", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:3.0.7-166.el9_7", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux:9"], "defaultStatus": "affected", "packageName": "ruby:4.0", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "9080020260513131334.9", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_e4s:9.0"], "defaultStatus": "affected", "packageName": "ruby", "product": "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:3.0.4-160.2.el9_0", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_e4s:9.2"], "defaultStatus": "affected", "packageName": "ruby", "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:3.0.4-161.el9_2.3", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_e4s:9.4"], "defaultStatus": "affected", "packageName": "ruby", "product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:3.0.7-162.el9_4.2", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_e4s:9.4"], "defaultStatus": "affected", "packageName": "ruby:3.3", "product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "9040020260520083544.9", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_eus:9.6"], "defaultStatus": "affected", "packageName": "ruby", "product": "Red Hat Enterprise Linux 9.6 Extended Update Support", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:3.0.7-165.el9_6.1", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_eus:9.6"], "defaultStatus": "affected", "packageName": "ruby:3.3", "product": "Red Hat Enterprise Linux 9.6 Extended Update Support", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "9060020260630075016.9", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:6"], "defaultStatus": "unaffected", "packageName": "ruby", "product": "Red Hat Enterprise Linux 6", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:7"], "defaultStatus": "unaffected", "packageName": "ruby", "product": "Red Hat Enterprise Linux 7", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:8"], "defaultStatus": "unaffected", "packageName": "ruby:2.5/ruby", "product": "Red Hat Enterprise Linux 8", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:hummingbird:1"], "defaultStatus": "unaffected", "packageName": "ruby3.3", "product": "Red Hat Hardened Images", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:hummingbird:1"], "defaultStatus": "unaffected", "packageName": "ruby3.4", "product": "Red Hat Hardened Images", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:hummingbird:1"], "defaultStatus": "unaffected", "packageName": "ruby4.0", "product": "Red Hat Hardened Images", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift:4"], "defaultStatus": "unaffected", "packageName": "openshift/ose-rhel-coreos-9", "product": "Red Hat OpenShift Container Platform 4", "vendor": "Red Hat"}], "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "ERB is a templating system for Ruby. Ruby 2.7.0 (before ERB 2.2.0 was published on rubygems.org) introduced an `@_init` instance variable guard in `ERB#result` and `ERB#run` to prevent code execution when an ERB object is reconstructed via `Marshal.load` (deserialization). However, three other public methods that also evaluate `@src` via `eval()` were not given the same guard: `ERB#def_method`, `ERB#def_module`, and `ERB#def_class`. An attacker who can trigger `Marshal.load` on untrusted data in a Ruby application that has `erb` loaded can use `ERB#def_module` (zero-arg, default parameters) as a code execution sink, bypassing the `@_init` protection entirely. ERB 4.0.3.1, 4.0.4.1, 6.0.1.1, and 6.0.4 patch the issue."}, {"lang": "es", "value": "ERB es un sistema de plantillas para Ruby. Ruby 2.7.0 (antes de que ERB 2.2.0 fuera publicado en rubygems.org) introdujo una protecci\u00f3n de variable de instancia \u201c@_init\u201d en \u201cERB#result\u201d y \u201cERB#run\u201d para prevenir la ejecuci\u00f3n de c\u00f3digo cuando un objeto ERB es reconstruido a trav\u00e9s de \u201cMarshal.load\u201d (deserializaci\u00f3n). Sin embargo, otros tres m\u00e9todos p\u00fablicos que tambi\u00e9n eval\u00faan \u201c@src\u201d a trav\u00e9s de \u201ceval()\u201d no recibieron la misma protecci\u00f3n: \u201cERB#def_method\u201d, \u201cERB#def_module\u201d y \u201cERB#def_class\u201d. Un atacante que pueda activar \u201cMarshal.load\u201d en datos no confiables en una aplicaci\u00f3n Ruby que tenga \u201cerb\u201d cargado puede usar \u201cERB#def_module\u201d (cero argumentos, par\u00e1metros predeterminados) como un sumidero de ejecuci\u00f3n de c\u00f3digo, eludiendo completamente la protecci\u00f3n \u201c@_init\u201d. ERB 4.0.3.1, 4.0.4.1, 6.0.1.1 y 6.0.4 aplican un parche al problema."}], "id": "CVE-2026-41316", "lastModified": "2026-10-26T22:10:00.163", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.9, "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-41316", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-04-25T01:45:02.467085Z", "version": "2.0.3"}}]}, "published": "2026-04-24T03:16:11.897", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/ruby/erb/security/advisories/GHSA-q339-8rmv-2mhv"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:18030"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:18039"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:18065"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:20596"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:20606"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:20614"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:20670"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:26312"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:26655"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:33462"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:33478"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:35834"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:37238"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/security/cve/CVE-2026-41316"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461369"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41316.json"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-693"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-502"}], "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "type": "Secondary"}]}

{"bugzilla": {"description": "erb: ERB: Arbitrary code execution via deserialization bypass", "id": "2461369", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461369"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.1", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-502", "details": ["A flaw was found in ERB, a templating system for Ruby. An attacker who can trigger deserialization of untrusted data in a Ruby application can bypass existing protections. This vulnerability allows for arbitrary code execution by exploiting specific public methods that evaluate template source code, which were not properly guarded against deserialization attacks."], "name": "CVE-2026-41316", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "ruby4.0", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "ruby3.3", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "ruby3.4", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "ruby4.0", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-04-24T02:35:41Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-41316\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-41316\nhttps://github.com/ruby/erb/security/advisories/GHSA-q339-8rmv-2mhv"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,4.0.3.1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.0.4"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[5.0.0,6.0.1.1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.0.2,6.0.4)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "erb", "source": "cna", "vendor": "ruby"}, "product": "erb", "vendor": "ruby"}], "analysis": {"en": {"generated_at": "2026-04-28T07:01:23.590623+00:00", "value": {"mitigation_remediation": ["Upgrade the ERB gem to at least 4.0.3.1, 4.0.4.1, 6.0.1.1, or 6.0.4 to fix the deserialization guard bypass.", "Restrict deserialization to trusted data sources to eliminate the possibility of loading malicious ERB objects.", "Remove or sanitize calls to ERB#def_module, ERB#def_method, and ERB#def_class in code paths that handle externally supplied inputs."], "summary": {"action": "Immediate Patch", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "Systems that use Ruby 2.7.0 with ERB versions older than 4.0.3.1, 4.0.4.1, 6.0.1.1 or 6.0.4 are affected. The vulnerability is present in any environment where the erb gem is loaded and an attacker can trigger Marshal.load on untrusted input. The patch is available in ERB 4.0.3.1 and later, including 4.0.4.1, 6.0.1.1, 6.0.4, so any Ruby application that depends on an older erb gem carries this risk.", "description_and_impact": "The vulnerability arises because ERB's deserialization guard was installed separately for result and run methods but omitted from public methods that also evaluate source code such as def_method, def_module and def_class. An attacker who can supply untrusted data to Marshal.load can instantiate an ERB object and then invoke def_module (or the other two methods) to execute arbitrary Ruby code. The missing guard permits the eval of the ERB source without checking the initialization flag, leading to remote code execution.\nThis falls under CWE-502 (Deserialization of Untrusted Data) and CWE-693 (Improper Handling of Security-relevant Manipulation).", "risk_and_exploitability": "With a CVSS score of 8.1 the vulnerability poses a high severity. The EPSS score is under 1%, indicating low current exploitation probability, and the issue is not listed in CISA KEV. The attack requires the ability to deserialize arbitrary ERB objects. If an attacker can deliver untrusted Marshal data, they can immediately obtain code execution through def_module, def_method or def_class. Due to the need for deserialization access, the likelihood in production environments is limited but not negligible. Therefore, any exposed surfaces that accept serialized data must be scrutinized, and upgrading to a patched gem is the recommended mitigation."}}}}, "created": "2026-04-28T07:15:19.368099+00:00", "updated": "2026-04-28T09:25:23.818582+00:00", "vendors": ["ruby", "ruby$PRODUCT$erb"]}