CVE-2026-41316: Red Hat Enterprise Linux 10
High severity, CVSS 8.1. EPSS: 1.3% chance of exploitation in the next 30 days.
ERB is a templating system for Ruby. Ruby 2.7.0 (before ERB 2.2.0 was published on rubygems.org) introduced an `@_init` instance variable guard in `ERB#result` and `ERB#run` to prevent code execution when an ERB object is reconstructed via `Marshal.load` (deserialization). However, three other public methods that also evaluate `@src` via `eval()` were not given the same guard: `ERB#def_method`, `ERB#def_module`, and `ERB#def_class`. An attacker who can trigger `Marshal.load` on untrusted data in a Ruby application that has `erb` loaded can use `ERB#def_module` (zero-arg, default parameters) as a code execution sink, bypassing the `@_init` protection entirely. ERB 4.0.3.1, 4.0.4.1, 6.0.1.1, and 6.0.4 patch the issue.
Affected products
- Red Hat Red Hat Enterprise Linux 10: before 0:3.3.10-12.el10_1 (fixed in 0:3.3.10-12.el10_1); before 0:4.0.3-34.el10_2 (fixed in 0:4.0.3-34.el10_2)
- Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support: before 0:3.3.10-11.el10_0.1 (fixed in 0:3.3.10-11.el10_0.1)
- Red Hat Red Hat Enterprise Linux 6
- Red Hat Red Hat Enterprise Linux 7
- Red Hat Red Hat Enterprise Linux 8: before 8100020260428163940.489197e6 (fixed in 8100020260428163940.489197e6)
- Red Hat Red Hat Enterprise Linux 9: before 9070020260428163621.9 (fixed in 9070020260428163621.9); before 0:3.0.7-166.el9_7 (fixed in 0:3.0.7-166.el9_7); before 9080020260513131334.9 (fixed in 9080020260513131334.9)
- Red Hat Red Hat Enterprise Linux 9.0 Update Services For SAP Solutions: before 0:3.0.4-160.2.el9_0 (fixed in 0:3.0.4-160.2.el9_0)
- Red Hat Red Hat Enterprise Linux 9.2 Update Services For SAP Solutions: before 0:3.0.4-161.el9_2.3 (fixed in 0:3.0.4-161.el9_2.3)
- Red Hat Red Hat Enterprise Linux 9.4 Update Services For SAP Solutions: before 0:3.0.7-162.el9_4.2 (fixed in 0:3.0.7-162.el9_4.2); before 9040020260520083544.9 (fixed in 9040020260520083544.9)
- Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support: before 0:3.0.7-165.el9_6.1 (fixed in 0:3.0.7-165.el9_6.1); before 9060020260630075016.9 (fixed in 9060020260630075016.9)
- Red Hat Red Hat Hardened Images
- Red Hat Red Hat Openshift Container Platform 4
- Ruby Erb: before 4.0.3.1 (fixed in 4.0.3.1); version 4.0.4 only; from 5.0.0, before 6.0.1.1 (fixed in 6.0.1.1); from 6.0.2, before 6.0.4 (fixed in 6.0.4)
Published 2026-04-24. Last modified 2026-08-24.