Ruby 4.0.3 Ships Emergency ERB Patch for CVE-2026-41316 as the Rust-Built ZJIT Era Enters Its First Maintenance Cycle
A deserialization guard bypass in ERB forced an out-of-band Ruby 4.0.3 on April 21, four months after 4.0's ZJIT debut established Ruby's new Rust-backed compiler.
Overview
Ruby 4.0.3 shipped on April 21, 2026, a maintenance release with a single purpose: fixing a deserialization flaw in the ERB templating library that lets an attacker bypass the guard meant to block remote code execution when a Ruby process unmarshals untrusted data. The vulnerability, tracked as CVE-2026-41316, arrived alongside the 4.0.3 announcement and marks the first notable security event for the Ruby 4.0 line, which launched on Christmas Day 2025 with an experimental Rust-built JIT compiler and a new in-process isolation mechanism called Ruby Box.
The 4.0.3 release notes are unusually terse. The entire release, according to ruby-lang.org, “only contains ERB 6.0.1.1, which fixes CVE-2026-41316.” The Ruby team also published a detailed security advisory the same day describing how three specific ERB methods sidestep an existing protection.
What We Know
The vulnerability
ERB, Ruby’s standard templating library, implements what the official advisory calls an “@_init guard to prevent code execution when ERB objects are reconstructed via Marshal.load on untrusted data.” The guard is supposed to prevent template source from being evaluated when an ERB instance arrives over the wire in serialized form.
The bug is that three ERB methods skip the guard entirely. As the advisory states, “ERB#def_method, ERB#def_module, and ERB#def_class evaluate the template source without checking this guard.” The same advisory notes that “def_module takes no arguments, making it straightforward to invoke as part of a deserialization gadget chain” — the practical consequence being that an attacker who can feed crafted bytes into Marshal.load can trigger template evaluation and, through it, arbitrary code execution.
The trigger conditions are specific. Any Ruby application that calls Marshal.load on untrusted input and has both erb and activesupport loaded is vulnerable. That profile fits legacy Rails applications that still rely on Marshal-serialized sessions, as well as Ruby tooling that round-trips objects through Marshal for caching or queueing.
The Ruby team credits the discovery to a researcher listed in the advisory as TristanInSec. The fix ships as ERB gem version 6.0.1.1; applications on older Ruby branches can also patch by upgrading the standalone gem to 4.0.3.1, 4.0.4.1, or 6.0.4, per the advisory.
The Ruby 4.0 context
Ruby 4.0.3 is the third point release since Ruby 4.0.0 shipped on December 25, 2025. The 4.0.0 release notes describe two flagship experimental features: ZJIT, a new just-in-time compiler written in Rust, and Ruby Box, an in-process isolation mechanism.
ZJIT is positioned as the successor to YJIT, the Shopify-developed JIT that has powered Ruby since 3.1. In a launch post on the Rails at Scale blog, the team behind ZJIT explained the motivation as two-fold: to “raise the performance ceiling (bigger compilation unit size and SSA IR) and encourage more outside contribution (by becoming a more traditional method compiler).” The same post conceded that ZJIT is not yet a drop-in upgrade: “It’s faster than the interpreter, but not yet as fast as YJIT. Yet.” The official 4.0.0 announcement echoed that caution with a direct recommendation: “We encourage you to experiment with ZJIT, but maybe hold off on deploying it in production for now.”
Building Ruby with ZJIT requires Rust 1.85.0 or newer, according to the 4.0 release notes, and the feature is gated behind a --zjit flag at configure time. This makes Ruby the latest major dynamic language to pull Rust into its core build pipeline, after CPython’s recent move to allow Rust in its source tree and Node.js’s parallel adoption for its native TypeScript layer.
Ruby Box, the other experimental headline in 4.0, targets a different problem: isolating monkey patches, global variables, class variables, and loaded native libraries inside named containers within a single Ruby process. The 4.0.0 announcement describes it as enabled via the RUBY_BOX=1 environment variable and aimed at use cases including protected test execution and blue-green deployments inside one interpreter.
Outside those two headliners, Ruby 4.0 promoted Set from stdlib to a core class, added Ractor::Port and Ractor.shareable_proc for parallel execution, updated Unicode handling to version 17.0, and removed several deprecated APIs including Ractor.yield and ObjectSpace._id2ref, according to the release notes.
The cadence
Ruby has historically shipped a major version every December 25. The 4.0 line has so far followed a steady patch rhythm: 4.0.1 on January 13, 2026; 4.0.2 on March 16; and 4.0.3 on April 21 in response to the ERB disclosure. The 4.0.3 announcement commits to a two-month cadence for the remainder of the branch, scheduling 4.0.4 for May, 4.0.5 for July, 4.0.6 for September, and 4.0.7 for November 2026.
What We Don’t Know
The advisory does not publish a CVSS score, and the National Vulnerability Database entry for CVE-2026-41316 was not yet populated at the time of the Ruby team’s announcement. Without a public severity rating it is harder for downstream distributions and enterprise scanners to automatically flag the issue, though the technical description — arbitrary code execution via a pre-authenticated Marshal deserialization gadget — is consistent with a high-severity vulnerability.
The advisory also does not enumerate which specific frameworks and gems were exercising the vulnerable code path in production. The combination of erb and activesupport is common in Rails applications, but whether any real-world exploitation has occurred before disclosure is not addressed in the published materials.
On the ZJIT side, the Rails at Scale post shows benchmark trajectories but does not commit to a specific Ruby 4.x version in which ZJIT will reach parity with YJIT. The team has said the goal is to make ZJIT production-ready and faster than YJIT in a future release, but the Ruby 4.0 announcement stops short of naming a target version. Whether YJIT will be retired once ZJIT overtakes it, or whether both will remain shipping compilers for a transitional period, is also unresolved in the published roadmap.
Analysis
The 4.0.3 patch reads as routine maintenance, but the underlying bug class is significant for Ruby’s security posture. Marshal-based deserialization attacks have been a recurring theme in the language’s security history, and ERB’s existing @_init guard was itself a response to earlier rounds of gadget-chain research. CVE-2026-41316 demonstrates that the guard was incomplete: three sibling methods on the same object — def_method, def_module, and def_class — reached the template-evaluation path without consulting the check. That is the kind of partial defense that tends to surface only when a researcher deliberately audits every code path that can lead to eval-equivalent behavior.
The fix in 6.0.1.1 short-circuits those three methods when they are called on Marshal-loaded instances, per the advisory. Applications that never call Marshal.load on untrusted input are not exposed, and Rails projects that have migrated to signed or encrypted session stores are similarly insulated. The population of genuinely at-risk deployments is therefore concentrated in older Rails stacks and custom Ruby services that still use Marshal as an RPC or caching format — a shrinking but non-trivial slice of production systems.
The broader story is the tempo of the Ruby 4.0 series. The Ruby core team has put ZJIT into the main distribution as an experimental feature, built on Rust, with the express expectation that it is not yet production-grade — and has paired that with a confident maintenance schedule through late 2026. That combination signals a language project willing to ship ambitious, long-horizon infrastructure work in its main line while keeping a conservative security response track for the stable features its users actually run in production today. The 4.0.3 patch is the first real test of that track, and by the measure of speed — disclosure and fix published the same day — the Ruby team passed.