---
title: "CVE-2026-41316: ERB @_init deserialization guard bypass via def_module / def_method / def_class"
url: https://daily.dev/posts/cve-2026-41316-erb-init-deserialization-guard-bypass-via-def-module-def-method-def-class-pzlvmxzk8
source_url: https://www.ruby-lang.org/en/news/2026/04/21/erb-cve-2026-41316/
type: article
source: "Ruby"
published: 2026-04-21T08:09:02.134Z
updated: 2026-04-22T08:26:11.115Z
tags: ["security", "ruby", "rails"]
reading_time: 2
upvotes: 2
comments: 0
language: en
---

> ## Documentation Index
> Fetch the complete documentation index at: https://daily.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# CVE-2026-41316: ERB @_init deserialization guard bypass via def_module / def_method / def_class

**[Ruby](https://daily.dev/sources/ruby)** · 2 min read · 2 upvotes · 0 comments

## Summary

A deserialization vulnerability (CVE-2026-41316) has been disclosed in the Ruby ERB gem. The flaw allows attackers to bypass the @_init guard that normally prevents code execution during Marshal.load deserialization, by invoking ERB#def_method, ERB#def_module, or ERB#def_class — which evaluate template source without checking the guard. Any Ruby application calling Marshal.load on untrusted data with both erb and activesupport loaded is vulnerable to arbitrary code execution, including all Ruby on Rails applications. The fix is to upgrade the erb gem to version 4.0.3.1, 4.0.4.1, 6.0.1.1, 6.0.4 or later. Versions 6.0.3 and below are affected.

## Full article

daily.dev links to this article rather than hosting it. Read it at the original source: <https://www.ruby-lang.org/en/news/2026/04/21/erb-cve-2026-41316/>

---

Tags: [#security](https://daily.dev/tags/security), [#ruby](https://daily.dev/tags/ruby), [#rails](https://daily.dev/tags/rails)

[View this post on daily.dev](https://daily.dev/posts/cve-2026-41316-erb-init-deserialization-guard-bypass-via-def-module-def-method-def-class-pzlvmxzk8)