Ruby: Remote code execution — GLSA 202609-03

{
  "id": "7db8567661b8256674a1e608026a38e9cb228b56995fdd4d4acd6f29ee32ed9d",
  "url": "https://security.gentoo.org/glsa/202609-03",
  "method": "llm",
  "payload": {
    "kind": "patch",
    "title": "Ruby: Remote code execution — GLSA 202609-03",
    "summary": "A vulnerability in Ruby may allow remote code execution. Gentoo identifies fixed versions for Ruby and ERB and recommends upgrading.",
    "evidence": "A vulnerability has been discovered in Ruby, possibly allowing remote code execution.",
    "products": [
      {
        "name": {
          "value": "dev-lang/ruby",
          "evidence": "Package dev-lang/ruby on all architectures"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "3.3.12",
            "evidence": "All Ruby 3.3 users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose \">=dev-lang/ruby-3.3.12:3.3\""
          },
          {
            "value": "3.4.10",
            "evidence": "All Ruby 3.4 users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose \">=dev-lang/ruby-3.4.10:3.4\""
          },
          {
            "value": "4.0.6",
            "evidence": "All Ruby 4.0 users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose \">=dev-lang/ruby-4.0.6:4.0\""
          }
        ],
        "affected_versions": [
          {
            "value": "< 3.3.12",
            "evidence": "Affected versions < 3.3.12"
          },
          {
            "value": "< 3.4.10",
            "evidence": "< 3.3.12 < 3.4.10 < 4.0.6"
          },
          {
            "value": "< 4.0.6",
            "evidence": "< 3.3.12 < 3.4.10 < 4.0.6"
          }
        ]
      },
      {
        "name": {
          "value": "dev-ruby/erb",
          "evidence": "Package dev-ruby/erb on all architectures"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "6.0.6",
            "evidence": "All ERB users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose \">=dev-ruby/erb-6.0.6:6\""
          }
        ],
        "affected_versions": [
          {
            "value": "< 6.0.6",
            "evidence": "Affected versions < 6.0.6"
          }
        ]
      }
    ],
    "severity": "high",
    "fixed_cves": [],
    "related_cves": [
      {
        "value": "CVE-2026-41316",
        "evidence": "References CVE-2026-41316"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "Severity high"
  },
  "source_id": "official-gentoo-glsa",
  "document_id": 23640,
  "published_at": "2026-09-12T00:00:00+00:00"
}