Critical Security Flaw in rubygem-mysql2: ERB Deserialization Bypass Vulnerability
Summary
RLSA-2026:18030: Important: ruby:3.3 security update. Affects rubygem-mysql2 versions < 0:0.5.5-3.module+el9.7.0+40032+36e56d0d. Fixed in 0:0.5.5-3.module+el9.7.0+40032+36e56d0d. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ruby is a versatile, interpreted, object-oriented scripting language widely used for web development and system management tasks. The rubygem-mysql2 package is a Ruby gem that provides a simple and efficient interface for connecting to MySQL databases. However, it has been identified that this package is vulnerable to a serious security issue that could allow arbitrary code execution through a deserialization bypass in the ERB (Embedded Ruby) templating system.
Vulnerability Detail
The vulnerability, identified as CVE-2026-41316, arises from a flaw in the ERB component of Ruby, which allows for arbitrary code execution via deserialization bypass. This means that an attacker could potentially exploit this vulnerability to execute malicious code on the server, leading to unauthorized access, data breaches, or system compromise. The CVSS score for this vulnerability is 8.1, indicating a high severity level that necessitates immediate attention.
How To Fix
Minimum fixed version
0:0.5.5-3.module+el9.7.0+40032+36e56d0d
This is the first release that contains the fix.
sudo dnf update rubygem-mysql2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can limit the use of ERB templates in your application until the package is updated. Additionally, review your code for any instances where user input is processed through ERB and sanitize it to prevent potential exploitation.
Conclusion
The rubygem-mysql2 package is affected by a critical security vulnerability that could allow arbitrary code execution through a deserialization bypass in ERB. It is crucial to update the package to the patched version to safeguard your application against potential attacks. Utilize tools like Vulert to monitor your software for vulnerabilities effectively.
See every vulnerability recorded for rubygem-mysql2 →
FAQ
CVE-2026-41316 is a security vulnerability in the ERB component of Ruby that allows for arbitrary code execution through deserialization bypass.
If your application uses the rubygem-mysql2 package and processes user input through ERB templates, it may be susceptible to this vulnerability, potentially allowing attackers to execute malicious code.
If an immediate update is not possible, consider limiting the use of ERB templates and sanitizing user inputs to mitigate the risk of exploitation.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By simply uploading your manifest file like package-lock.json, you can check for vulnerabilities without needing to install any software.
The CVSS score for this vulnerability is 8.1, indicating a high level of severity that requires prompt action.
Related vulnerabilities
Recent vulnerabilities recorded for rubygem-mysql2.
