RubyFlow The Ruby and Rails community linklog

×

The Ruby and Rails community linklog

Made a library? Written a blog post? Found a useful tutorial? Share it with the Ruby community here or just enjoy what everyone else has found!

Ruby 4.0.3 fixes a serious ERB deserialization issue (CVE-2026-41316).

by Giménez Silva Germán Alberto —

https://rubystacknews.com/2026/04/21/ruby-4-0-3-released-critical-erb-deserialization-fix/

ERB#def_method, def_module, def_class bypass the @_init guard → RCE via Marshal.load.

Rails apps are especially exposed.

Upgrade now.

Post a comment

You can use basic HTML markup (e.g. <a>) or Markdown.

As you are not logged in, you will be
directed via GitHub to signup or sign in