A critical deserialization flaw in the Ruby ERB library allows unauthenticated attackers to achieve remote code execution, posing a severe risk to application integrity.

The vulnerability stems from a protection mechanism failure where specific public methods, including ERB#def_method, ERB#def_module, and ERB#def_class, fail to implement the @_init instance variable guard present in other methods. An unauthenticated attacker can exploit this by triggering Marshal.load on untrusted data, using these methods as a sink for arbitrary code execution.

This vulnerability carries a CVSS score of 8.1, reflecting its potential for total compromise of the affected application. Successful exploitation allows for remote code execution, which may lead to full system takeover, unauthorized data access, and significant reputational damage to the organization.

Immediate Action: Update the Ruby ERB gem to version 4.0.3.1, 4.0.4.1, 6.0.1.1, or 6.0.4, depending on the current environment branch.

Proactive Monitoring: Review application logs for suspicious deserialization activity or unexpected calls to Marshal.load involving untrusted user input.

Compensating Controls: Implement strict input validation and avoid passing untrusted data to Marshal.load functions. Utilize language-level security policies to restrict dangerous method calls if patching cannot be performed immediately.

Public Exploit Available: Unknown

Given the high impact of remote code execution, organizations should prioritize updating the ERB library across all affected Ruby environments. Security teams must verify their dependency trees to identify vulnerable versions and ensure that patches are applied to stabilize the application infrastructure immediately.