ERB, a templating system for Ruby, contains a deserialization vulnerability that allows remote code execution. The vulnerability exists in three public methods (ERB#def_method, ERB#def_module, ERB#def_class) that bypass @_init protection when ERB objects are reconstructed via Marshal.load. Attackers can exploit ERB#def_module to achieve code execution on Ruby applications with erb loaded when processing untrusted data. The vulnerability affects Ruby 2.7.0+ before ERB 2.2.0 and is patched in ERB versions 4.0.3.1, 4.0.4.1, 6.0.1.1, and 6.0.4.