ERB, a Ruby templating system, introduced a guard in Ruby 2.7.0 to prevent code execution during deserialization via Marshal.load by using an instance variable guard (@_init) in ERB#result and ERB#run. However, three other public methods—ERB#def_method, ERB#def_module, and ERB#def_class—that also evaluate template source code with eval() lacked this guard. An attacker able to trigger Marshal.load on untrusted data can exploit ERB#def_module to bypass the @_init protection and achieve arbitrary code execution. The vulnerability is identified as CWE-693 (Protection Mechanism Failure) and CWE-502 (Deserialization of Untrusted Data). It has a CVSS v3.1 score of 8.1 (high severity) with network attack vector, high attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. Red Hat has released patches for affected versions and provides advisories and updates for their supported products.

This vulnerability allows an attacker who can cause deserialization of untrusted data in a Ruby application using ERB to execute arbitrary code remotely. The impact includes full compromise of confidentiality, integrity, and availability of the affected system. The vulnerability can be exploited without user interaction or privileges but requires high attack complexity. It can lead to unauthorized code execution, data modification, and denial of service.

A fix is available and should be applied by upgrading to patched versions of ERB (4.0.3.1, 4.0.4.1, 6.0.1.1, or 6.0.4) or the corresponding Ruby packages provided by vendors such as Red Hat. Red Hat has released security updates for affected Enterprise Linux versions and recommends applying these updates promptly. If upgrading is not immediately possible, avoid deserializing untrusted data with Marshal.load in applications using ERB. Follow vendor advisories for detailed update instructions.