9 matches found
CLSA-2026-1779745996 ruby: Fix of CVE-2026-41316
CVE-2026-41316: prohibit ERBdefmethod on marshal-loaded ERB instances by extending the @init singleton-class guard to defmethod and transitively defmodule/defclass, preventing RCE via Marshal.load gadgets...
GHSA-Q339-8RMV-2MHV ERB has an @_init deserialization guard bypass via def_module / def_method / def_class
Summary Ruby 2.7.0 before ERB 2.2.0 was published on rubygems.org introduced an @init instance variable guard in ERBresult and ERBrun to prevent code execution when an ERB object is reconstructed via Marshal.load deserialization. However, three other public methods that also evaluate @src via eva...
ERB has an @_init deserialization guard bypass via def_module / def_method / def_class
Summary Ruby 2.7.0 before ERB 2.2.0 was published on rubygems.org introduced an @init instance variable guard in ERBresult and ERBrun to prevent code execution when an ERB object is reconstructed via Marshal.load deserialization. However, three other public methods that also evaluate @src via eva...
CVE-2026-41316 ERB has an @_init deserialization guard bypass via def_module / def_method / def_class
ERB is a templating system for Ruby. Ruby 2.7.0 before ERB 2.2.0 was published on rubygems.org introduced an @init instance variable guard in ERBresult and ERBrun to prevent code execution when an ERB object is reconstructed via Marshal.load deserialization. However, three other public methods th...
CVE-2026-41316 ERB has an @_init deserialization guard bypass via def_module / def_method / def_class
ERB is a templating system for Ruby. Ruby 2.7.0 before ERB 2.2.0 was published on rubygems.org introduced an @init instance variable guard in ERBresult and ERBrun to prevent code execution when an ERB object is reconstructed via Marshal.load deserialization. However, three other public methods th...
CVE-2026-41316
ERB has a deserialization guard for @_init in ERB#result and ERB#run, but public methods ERB#def_method, ERB#def_module, and ERB#def_class were not guarded. The vulnerability arises when Marshal.load is used on untrusted data with erb loaded, allowing code execution via the unguarded paths. Patch...
CVE-2026-41316 ERB has an @_init deserialization guard bypass via def_module / def_method / def_class
ERB is a templating system for Ruby. Ruby 2.7.0 before ERB 2.2.0 was published on rubygems.org introduced an @init instance variable guard in ERBresult and ERBrun to prevent code execution when an ERB object is reconstructed via Marshal.load deserialization. However, three other public methods th...
ERB has an @_init deserialization guard bypass via def_module / def_method / def_class
ERB implements an @init guard to prevent code execution when ERB objects are reconstructed via Marshal.load on untrusted data. However, ERBdefmethod, ERBdefmodule, and ERBdefclass evaluate the template source without checking this guard, allowing an attacker who controls the data passed to...
ERB has an @_init deserialization guard bypass via def_module / def_method / def_class
ERB implements an @init guard to prevent code execution when ERB objects are reconstructed via Marshal.load on untrusted data. However, ERBdefmethod, ERBdefmodule, and ERBdefclass evaluate the template source without checking this guard, allowing an attacker who controls the data passed to...