ERB is a templating system for Ruby. Ruby 2.7.0 (before ERB 2.2.0 was published on rubygems.org) introduced an `@_init` instance variable guard in `ERB#result` and `ERB#run` to prevent code execution when an ERB object is reconstructed via `Marshal.load` (deserialization). However, three other public methods that also evaluate `@src` via `eval()` were not given the same guard: `ERB#def_method`, `ERB#def_module`, and `ERB#def_class`. An attacker who can trigger `Marshal.load` on untrusted data in a Ruby application that has `erb` loaded can use `ERB#def_module` (zero-arg, default parameters) as a code execution sink, bypassing the `@_init` protection entirely. ERB 4.0.3.1, 4.0.4.1, 6.0.1.1, and 6.0.4 patch the issue.
CVSS Details
- CVSS 3.1 Base Score: 8.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade ruby-docUpgrade rubygem-rbsUpgrade rubygem-raccUpgrade rubygem-abrtUpgrade ruby-bundled-gemsUpgrade rubygem-test-unitUpgrade rubygem-rssUpgrade rubygem-bigdecimalUpgrade rubyUpgrade ruby-develUpgrade rubygem-rexmlUpgrade rubygem-io-consoleUpgrade rubygem-irbUpgrade rubygem-bundlerUpgrade rubygem-rakeUpgrade rubygem-jsonUpgrade rubygem-rdocUpgrade rubygem-minitestUpgrade rubygemsUpgrade rubygem-psychUpgrade ruby-default-gemsUpgrade rubygem-pgUpgrade rubygem-power_assertUpgrade ruby-libsUpgrade rubygems-develUpgrade rubygem-abrt-docUpgrade rubygem-mysql2-docUpgrade rubygem-typeprofUpgrade rubygem-mysql2Upgrade rubygem-pg-doc | May 20, 2026 | May 18, 2026 |
| Amazon Linux Ami 2 | — | Upgrade ruby-docUpgrade rubygem-io-consoleUpgrade rubygem-psychUpgrade rubygem-rakeUpgrade ruby-debuginfoUpgrade rubygems-develUpgrade ruby-develUpgrade rubygem-bigdecimalUpgrade rubygem-rdocUpgrade rubygem-jsonUpgrade rubygem-minitestUpgrade ruby-libsUpgrade ruby-irbUpgrade rubygemsUpgrade ruby-tcltkUpgrade ruby | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade ruby3.4-rubygem-io-consoleUpgrade ruby3.4-bundled-gems-debuginfoUpgrade ruby3.4-bundled-gemsUpgrade ruby3.4-libsUpgrade ruby3.4-docUpgrade ruby3.4-rubygem-json-debuginfoUpgrade ruby3.4-rubygem-test-unitUpgrade ruby3.4-rubygem-rbsUpgrade ruby3.4-rubygem-rdocUpgrade ruby3.4-rubygem-minitestUpgrade ruby3.4-default-gemsUpgrade ruby3.4-rubygem-bigdecimal-debuginfoUpgrade ruby3.4-rubygem-psychUpgrade ruby3.4-rubygemsUpgrade ruby3.4-libs-debuginfoUpgrade ruby3.4-rubygem-racc-debuginfoUpgrade ruby3.4Upgrade ruby3.4-debugsourceUpgrade ruby3.4-rubygem-rbs-debuginfoUpgrade ruby3.4-debuginfoUpgrade ruby3.4-rubygem-psych-debuginfoUpgrade ruby3.4-rubygem-bigdecimalUpgrade ruby3.4-rubygem-irbUpgrade ruby3.4-rubygem-jsonUpgrade ruby3.4-rubygem-bundlerUpgrade ruby3.4-rubygems-develUpgrade ruby3.4-rubygem-power_assertUpgrade ruby3.4-rubygem-typeprofUpgrade ruby3.4-rubygem-rakeUpgrade ruby3.4-rubygem-io-console-debuginfoUpgrade ruby3.4-rubygem-raccUpgrade ruby3.4-develUpgrade ruby3.4-rubygem-rssUpgrade ruby3.4-rubygem-rexml | May 19, 2026 | Apr 24, 2026 |
| Debian | — | Upgrade ruby2.7 | Aug 5, 2026 | Aug 5, 2026 |
| Gentoo Linux | — | Upgrade dev-ruby/erb.Upgrade dev-lang/ruby. | Sep 14, 2026 | Sep 12, 2026 |
| Oracle_linux | — | Upgrade rubyUpgrade rubygem-bundlerUpgrade rubygem-rdocUpgrade rubygem-raccUpgrade rubygem-rakeUpgrade rubygem-jsonUpgrade ruby-develUpgrade rubygem-abrtUpgrade ruby-default-gemsUpgrade rubygem-mysql2-docUpgrade rubygem-rssUpgrade rubygem-io-consoleUpgrade rubygem-rexmlUpgrade rubygem-rbsUpgrade rubygem-mysql2Upgrade ruby-docUpgrade ruby-bundled-gemsUpgrade rubygem-irbUpgrade rubygem-bigdecimalUpgrade rubygem-power_assertUpgrade rubygems-develUpgrade rubygem-abrt-docUpgrade rubygem-psychUpgrade rubygemsUpgrade ruby-libsUpgrade rubygem-test-unitUpgrade rubygem-pg-docUpgrade rubygem-pgUpgrade rubygem-typeprofUpgrade rubygem-minitest | May 21, 2026 | Apr 24, 2026 |
| Redhat_linux | — | Upgrade rubygem-pgUpgrade ruby-develUpgrade rubygem-irbUpgrade rubygem-pg-debugsourceUpgrade ruby4.0-develUpgrade rubygem-mysql2Upgrade rubygem-minitestUpgrade ruby-bundled-gemsUpgrade ruby-default-gemsUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-power_assertUpgrade rubygem-rbsUpgrade rubygem-abrt-docUpgrade ruby-bundled-gems-debuginfoUpgrade rubygemsUpgrade ruby4.0-debuginfoUpgrade rubygem-abrtUpgrade rubyUpgrade ruby-libsUpgrade rubygem-pg-docUpgrade rubygem-jsonUpgrade ruby-libs-debuginfoUpgrade rubygem-typeprofUpgrade rubygem-bundlerUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-rexmlUpgrade ruby4.0Upgrade rubygem-rakeUpgrade ruby4.0-rubygem-pg-debuginfoUpgrade rubygem-rbs-debuginfoUpgrade rubygem-json-debuginfoUpgrade ruby-debugsourceUpgrade rubygem-rdocUpgrade rubygem-io-consoleUpgrade ruby4.0-rubygem-mysql2Upgrade ruby4.0-docUpgrade rubygem-pg-debuginfoUpgrade rubygem-bigdecimalUpgrade rubygem-mysql2-docUpgrade ruby4.0-debugsourceUpgrade rubygems-develUpgrade rubygem-racc-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade rubygem-test-unitUpgrade rubygem-raccUpgrade ruby4.0-rubygem-mysql2-debuginfoUpgrade rubygem-mysql2-debuginfoUpgrade ruby-docUpgrade rubygem-psychUpgrade ruby-debuginfoUpgrade ruby4.0-rubygem-pgUpgrade rubygem-psych-debuginfoUpgrade rubygem-rss | May 19, 2026 | Apr 24, 2026 |
| Rocky_linux | — | Upgrade rubygem-psychUpgrade ruby4.0-develUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-rbsUpgrade rubygem-pgUpgrade rubyUpgrade ruby-libs-debuginfoUpgrade ruby4.0-rubygem-pg-debuginfoUpgrade rubygem-jsonUpgrade ruby-bundled-gemsUpgrade ruby-debugsourceUpgrade rubygem-pg-debugsourceUpgrade ruby4.0-debuginfoUpgrade ruby-libsUpgrade ruby-develUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-pg-debuginfoUpgrade rubygem-mysql2Upgrade ruby-bundled-gems-debuginfoUpgrade ruby4.0-rubygem-mysql2-debuginfoUpgrade rubygem-rbs-debuginfoUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-io-console-debuginfoUpgrade ruby4.0-rubygem-mysql2Upgrade rubygem-psych-debuginfoUpgrade ruby4.0Upgrade rubygem-json-debuginfoUpgrade rubygem-io-consoleUpgrade ruby4.0-rubygem-pgUpgrade rubygem-bigdecimalUpgrade ruby4.0-debugsourceUpgrade ruby-debuginfoUpgrade rubygem-racc-debuginfoUpgrade rubygem-racc | May 21, 2026 | May 19, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub