ruby erb vulnerabilities

Latest ruby erb CVEs

Newest publication first

1. CVE-2026-41316 ERB has an @_init deserialization guard bypass via def_module / def_method / def_class

   Published 2026-04-24

   High·CVSS 8.1 EPSS 1.1% PoC

   ERB is a templating system for Ruby. Ruby 2.7.0 (before ERB 2.2.0 was published on rubygems.org) introduced an @_init instance variable guard in ERB#result and ERB#run to prevent code execution when an ERB object is reconstructed via Marshal.load (deserialization). However, three...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.