Ruby's ERB templating system introduced an instance variable guard (@_init) in version 2.7.0 to prevent code execution during deserialization via Marshal.load. However, this guard was not applied to three public methods—ERB#def_method, ERB#def_module, and ERB#def_class—that also evaluate the source code (@src) using eval(). An attacker who can cause Marshal.load on untrusted data in an application with ERB loaded can exploit ERB#def_module with default parameters to bypass the @_init guard and execute arbitrary code. This vulnerability affects multiple ERB versions prior to 4.0.3.1 and certain later versions as specified. The issue is patched in ERB versions 4.0.3.1, 4.0.4.1, 6.0.1.1, and 6.0.4.

Successful exploitation allows an attacker to execute arbitrary code remotely without privileges or user interaction, impacting confidentiality, integrity, and availability of the affected system. This can lead to full system compromise in applications that deserialize untrusted data using Marshal.load with vulnerable ERB versions.

Patch to ERB versions 4.0.3.1, 4.0.4.1, 6.0.1.1, or 6.0.4 where the vulnerability is fixed. Since no vendor advisory or official patch links are provided, verify patch availability from the official Ruby or ERB project sources. Avoid deserializing untrusted data with Marshal.load as a general best practice. Patch status is not yet confirmed in the provided data; check the vendor advisory for current remediation guidance.