Intel

CVE-2026-41316

Security update for ruby2.5

highEPSS 1.1%

Description

ERB is a templating system for Ruby. Ruby 2.7.0 (before ERB 2.2.0 was published on rubygems.org) introduced an `@_init` instance variable guard in `ERB#result` and `ERB#run` to prevent code execution when an ERB object is reconstructed via `Marshal.load` (deserialization). However, three other public methods that also evaluate `@src` via `eval()` were not given the same guard: `ERB#def_method`, `ERB#def_module`, and `ERB#def_class`. An attacker who can trigger `Marshal.load` on untrusted data in a Ruby application that has `erb` loaded can use `ERB#def_module` (zero-arg, default parameters) as a code execution sink, bypassing the `@_init` protection entirely. ERB 4.0.3.1, 4.0.4.1, 6.0.1.1, and 6.0.4 patch the issue.

Source: BSIBSI_CSAFBSIBSI_CSAFSUSE_CSAFBSIBSI_CSAFOSVNVDCVEORGCVELISTV5

Metrics

Severity
high
Priority score
108.53
KEV status
—
Exploit maturity
no public PoC known
XIEM Effective CVSS
8.1
Source: nvd-v3
CVSS v3
8.1
CVSS v4
—
EPSS percentile
64.5 %
High — this CVE ranks above the median of all CVEs scored today (rank ≥ 36%).
EPSS score
1.1 %
Moderate — model estimates 1-10% exploitation likelihood.
Published
2026-08-10 17:56 UTC
CWE
CWE-693

Weakness classes (CWE)

  • CWE-693Pillar

    Protection Mechanism Failure

    The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

    cwe.mitre.org →

Reanalysis & status changes

Chronological NVD audit events for this CVE — reanalyses, CVSS updates, CPE diffs.

  1. CVE Modified2026-08-24 13:18 UTC· 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
    • Affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support (+17) → Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support (+17)
  2. CVE Modified2026-08-05 13:22 UTC· 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
    • Affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support (+17) → Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support (+17)
  3. CVE Modified2026-07-06 13:16 UTC· 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
    • Reference: https://access.redhat.com/errata/RHSA-2026:35834
    • Affected: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux AppStream (v. 8) (+13) → Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux AppStream (v. 8) (+14)

Affected products

Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.

  • rubygems

    erb2.2.0

  • rubygems

    erb2.2.1

  • rubygems

    erb2.2.2

  • rubygems

    erb2.2.3

  • rubygems

    erb3.0.0

  • rubygems

    erb4.0.0

  • rubygems

    erb4.0.1

  • rubygems

    erb4.0.2

  • rubygems

    erb4.0.3

  • rubygems

    erb4.0.4

  • rubygems

    erb5.0.0

  • rubygems

    erb5.0.1

  • rubygems

    erb5.0.2

  • rubygems

    erb5.0.3

  • rubygems

    erb5.1.0

  • rubygems

    erb5.1.1

  • rubygems

    erb5.1.2

  • rubygems

    erb5.1.3

  • rubygems

    erb6.0.0

  • rubygems

    erb6.0.1

  • rubygems

    erb6.0.2

  • rubygems

    erb6.0.3

References & sources

IDCVE-2026-41316