Skip to content
OpenAdvisories

Product · ruby

erb

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 8.1
    CVE-2026-41316

    ERB has an @_init deserialization guard bypass via def_module / def_method / def_class

    ERB is a templating system for Ruby. Ruby 2.7.0 (before ERB 2.2.0 was published on rubygems.org) introduced an `@_init` instance variable guard in `ERB#result` and `ERB#run` to prevent code execution when an ERB object is reconstructed via `Marshal.load` (des…

    ruby erb ruby2.3 ruby Debian Ubuntu Alpine RubyGems