CVE-2026-41316 is a protection mechanism failure in Ruby's ERB templating system. Ruby 2.7.0 introduced an instance variable guard (@_init) in ERB#result and ERB#run to prevent code execution when an ERB object is deserialized via Marshal.load. However, three other public methods—ERB#def_method, ERB#def_module, and ERB#def_class—that also evaluate the source code via eval() lacked this guard. An attacker able to trigger Marshal.load on untrusted data can exploit ERB#def_module to bypass the @_init guard and achieve arbitrary code execution. The vulnerability is addressed in ERB versions 4.0.3.1, 4.0.4.1, 6.0.1.1, and 6.0.4. Red Hat advisories provide patches for affected Red Hat Enterprise Linux versions.

Successful exploitation allows an attacker to execute arbitrary code in the context of the Ruby application using ERB, leading to full confidentiality, integrity, and availability compromise. The CVSS v3.1 score is 8.1 (High), reflecting network attack vector, high impact on confidentiality, integrity, and availability, and requiring no privileges or user interaction but with high attack complexity.

Fixes are available and have been released in ERB versions 4.0.3.1, 4.0.4.1, 6.0.1.1, and 6.0.4. Users should upgrade to these or later patched versions. Red Hat has issued security advisories and errata with updated packages for affected Red Hat Enterprise Linux versions. Applying these vendor-provided updates will remediate the vulnerability. Patch status is confirmed by vendor advisories linked in the references.