8.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-41316

CVE-2026-41316: ERB has an @_init deserialization guard bypass via def_module / def_method / def_class

ERB is a templating system for Ruby. Ruby 2.7.0 (before ERB 2.2.0 was published on rubygems.org) introduced an @_init instance variable guard in ERB#result and ERB#run to prevent code execution when an ERB object is reconstructed via Marshal.load (deserialization). However, three other public methods that also evaluate @src via eval() were not given the same guard: ERB#def_method, ERB#def_module, and ERB#def_class. An attacker who can trigger Marshal.load on untrusted data in a Ruby application that has erb loaded can use ERB#def_module (zero-arg, default parameters) as a code execution sink, bypassing the @_init protection entirely. ERB 4.0.3.1, 4.0.4.1, 6.0.1.1, and 6.0.4 patch the issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-41316

CVE-2026-41316:

8.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
erb	rubygems	< 4.0.3.1	4.0.3.1
erb	rubygems	= 4.0.4	4.0.4.1
erb	rubygems	>= 5.0.0, < 6.0.1.1	6.0.1.1
erb	rubygems	>= 6.0.2, < 6.0.4	6.0.4

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the erb library's handling of deserialized objects. The ERB class has an @_init instance variable that is set during initialization to prevent methods that evaluate code from running on objects reconstructed from Marshal.load. However, the methods def_method, def_module, and def_class did not perform this check before evaluating the @src instance variable, which can contain user-controlled code.

The patch was applied to def_method to include the @_init check. Since def_module and def_class both call def_method, this single patch mitigates the vulnerability for all three methods. An attacker could exploit this by crafting a serialized ERB object with malicious code in the @src variable. When a Ruby application deserializes this object and a method like def_module is called on it (which can happen in gadget chains), the malicious code is executed.

Vulnerable functions

ERB.def_method

lib/erb.rb

This function was vulnerable because it did not check if the ERB object was initialized before calling `eval` on the `@src` instance variable. An attacker could create a crafted ERB object, serialize it, and when a victim deserializes it using `Marshal.load`, the `@_init` guard is bypassed. Calling `def_method` on this object would lead to code execution.

ERB.def_module

lib/erb.rb

This function is vulnerable because it calls the vulnerable `ERB.def_method` function. An attacker can use this function as an entry point to trigger the vulnerability in `def_method`. The proof of concept demonstrates an exploit using `def_module`.

ERB.def_class

lib/erb.rb

Similar to `ERB.def_module`, this function is vulnerable because it calls the vulnerable `ERB.def_method` function, providing another vector for an attacker to trigger the code execution vulnerability.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.