Ruby — CVE-2026-41316: ERB @_init deserialization guard bypass via def_module / def_method / def_class

Apr 21, 2026 · 3 months ago

CVE-2026-41316: ERB @_init deserialization guard bypass via def_module / def_method / def_class

We published security advisory for CVE-2026-41316. CVE-2026-41316: ERB @_init deserialization guard bypass via def_module / def_method / def_class A deserialization vulnerability exists in ERB. This v…

Security

Fix deserialization vulnerability in ERB @_init guard bypass via def_module, def_method, and def_class

View original