Skip to content
Threat Feed

Tag

Rails

2 briefs RSS
critical advisory

ERB Deserialization Bypass via def_module/def_method/def_class

A deserialization vulnerability exists in Ruby ERB versions before 4.0.3.1, version 4.0.4, ERB versions 5.0.0 before 6.0.1.1, and ERB versions 6.0.2 before 6.0.4. The `@_init` instance variable guard in `ERB#result` and `ERB#run` can be bypassed via `ERB#def_module`, `ERB#def_method`, and `ERB#def_class`, allowing arbitrary code execution when an ERB object is reconstructed via `Marshal.load` on untrusted data.

ERB deserialization rce ruby rails
2r 2t 1c
medium advisory

Ruby on Rails Active Storage DoS Vulnerability (CVE-2026-33174)

A denial-of-service vulnerability (CVE-2026-33174) exists in Ruby on Rails Active Storage versions prior to 8.1.2.1, 8.0.4.1, and 7.2.3.1 due to unbounded memory allocation when handling large or unbounded Range headers in proxy delivery mode.

rails active-storage dos cve-2026-33174
2r 1t