A remote code execution vulnerability (CVE-2026-41316, CVSS 8.1) affects Ruby versions prior to 3.3.12, 3.4.10, and 4.0.6, as well as the ERB library prior to version 6.0.6. The specific attack vector is not detailed in the provided information. The resolution is to upgrade Ruby to versions 3.3.12, 3.4.10, or 4.0.6 and ERB to version 6.0.6, as no workaround is currently available.
A vulnerability has been discovered in Ruby, possibly allowing remote code execution. Affected packages Package dev-lang/ruby on all architectures Affected versions < 3.3.12 < 3.4.10 < 4.0.6 Unaffected versions >= 3.3.12 >= 3.4.10 >= 4.0.6 Package dev-ruby/erb on all architectures Affected versions < 6.0.6 Unaffected versions >= 6.0.6 Background Ruby is an interpreted scripting language for quick and easy object-oriented programming. Description A vulnerability has been discovered in Ruby. Please review the CVE identifier referenced below for details. Impact Remote code execution is possible. Workaround There is no known workaround at this time. Resolution All Ruby 3.3 users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=dev-lang/ruby-3.3.12:3.3" All Ruby 3.4 users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=dev-lang/ruby-3.4.10:3.4" All Ruby 4.0 users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=dev-lang/ruby-4.0.6:4.0" All ERB users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=dev-ruby/erb-6.0.6:6" References CVE-2026-41316 GHSA-q339-8rmv-2mhv Release date September 12, 2026 Latest revision September 12, 2026: 1 Severity high Exploitable remote Bugzilla entries 979773