AIKIDO-2026-467095

erb is vulnerable to Deserialization of Untrusted Data

Deserialization of Untrusted Data Pre-CVE Published 6 days ago

High Risk

This Affects:

erb

2.2.0 - 6.0.4

Fixed in 6.0.5

Are you affected? Scan for Free

TL;DR

ERB guards ERB#result and ERB#def_method against execution on marshal-loaded instances by checking whether the @_init instance variable is the class singleton. The guard calls equal? directly on @_init, a value an attacker fully controls when an ERB object is reconstructed through Marshal.load. An attacker-supplied @_init object that overrides equal? to return true defeats the check, letting the template source in @src reach eval and execute arbitrary code. The fix performs the identity comparison through BasicObject#equal? bound via UnboundMethod#bind_call, so an overridden equal? can no longer bypass the guard.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and your application calls Marshal.load on untrusted data while the erb library is loaded.