The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - ERB is a templating system for Ruby. Ruby 2.7.0 (before ERB 2.2.0 was published on rubygems.org)     introduced an `@_init` instance variable guard in `ERB#result` and `ERB#run` to prevent code execution     when an ERB object is reconstructed via `Marshal.load` (deserialization). However, three other public     methods that also evaluate `@src` via `eval()` were not given the same guard: `ERB#def_method`,     `ERB#def_module`, and `ERB#def_class`. An attacker who can trigger `Marshal.load` on untrusted data in a     Ruby application that has `erb` loaded can use `ERB#def_module` (zero-arg, default parameters) as a code     execution sink, bypassing the `@_init` protection entirely. ERB 4.0.3.1, 4.0.4.1, 6.0.1.1, and 6.0.4 patch     the issue. (CVE-2026-41316)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-41316

high Nessus Plugin ID 310176

Version 1.4

Version 1.3

Version 1.2

Version 1.1

Version 1.4 Apr 30, 2026, 3:55 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202604300355
Version 1.3 Apr 29, 2026, 12:50 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202604291250
Version 1.2 Apr 26, 2026, 5:43 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202604260543
Version 1.1 Apr 25, 2026, 1:42 AM New Plugin Feed: 202604250142