From 25a17f229ab83fcd7f5b83342d4d86e5a63f3873 Mon Sep 17 00:00:00 2001
From: John Ford <12647+iamjohnford@users.noreply.github.com>
Date: Sat, 8 Aug 2026 13:34:12 -0400
Subject: [PATCH 1/2] Add 3.3.12 and 3.4.10 to CVE-2026-41316 patched_versions

---
 gems/erb/CVE-2026-41316.yml    | 1 +
 rubies/ruby/CVE-2026-41316.yml | 7 +++++--
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/gems/erb/CVE-2026-41316.yml b/gems/erb/CVE-2026-41316.yml
index 2b77b4a548..8b73865739 100644
--- a/gems/erb/CVE-2026-41316.yml
+++ b/gems/erb/CVE-2026-41316.yml
@@ -27,6 +27,7 @@ related:
   url:
     - https://nvd.nist.gov/vuln/detail/CVE-2026-41316
     - https://www.ruby-lang.org/en/news/2026/07/16/ruby-3-3-12-released
+    - https://www.ruby-lang.org/en/news/2026/06/30/ruby-3-4-10-released
     - https://www.ruby-lang.org/en/news/2026/04/21/ruby-4-0-3-released
     - https://www.ruby-lang.org/en/news/2026/04/21/erb-cve-2026-41316
     - https://github.com/ruby/erb/blob/master/NEWS.md
diff --git a/rubies/ruby/CVE-2026-41316.yml b/rubies/ruby/CVE-2026-41316.yml
index 203546030b..d55e68bc8f 100644
--- a/rubies/ruby/CVE-2026-41316.yml
+++ b/rubies/ruby/CVE-2026-41316.yml
@@ -15,14 +15,17 @@ description: |
   arbitrary code. In particular, def_module takes no arguments, making
   it straightforward to invoke as part of a deserialization gadget chain.
 
-  Please update to Ruby 4.0.3 which "only contains ERB 6.0.1.1,
-  which fixes CVE-2026-41316."
+  Please update to Ruby 3.3.12, 3.4.10, 4.0.3 or later.
 cvss_v3: 8.1
 patched_versions:
+  - "~> 3.3.12"
+  - "~> 3.4.10"
   - ">= 4.0.3"
 related:
   url:
     - https://nvd.nist.gov/vuln/detail/CVE-2026-41316
+    - https://www.ruby-lang.org/en/news/2026/07/16/ruby-3-3-12-released
+    - https://www.ruby-lang.org/en/news/2026/06/30/ruby-3-4-10-released
     - https://www.ruby-lang.org/en/news/2026/04/21/ruby-4-0-3-released
     - https://www.ruby-lang.org/en/news/2026/04/21/erb-cve-2026-41316
     - https://github.com/ruby/erb/blob/master/NEWS.md

From 1c8d10ec3fdcafec69aa2a2b03a24e05484be920 Mon Sep 17 00:00:00 2001
From: John Ford <12647+iamjohnford@users.noreply.github.com>
Date: Sat, 8 Aug 2026 14:59:24 -0400
Subject: [PATCH 2/2] Add ruby/ruby backport PRs to related URLs

---
 gems/erb/CVE-2026-41316.yml    | 2 ++
 rubies/ruby/CVE-2026-41316.yml | 2 ++
 2 files changed, 4 insertions(+)

diff --git a/gems/erb/CVE-2026-41316.yml b/gems/erb/CVE-2026-41316.yml
index 8b73865739..bae3f8aa16 100644
--- a/gems/erb/CVE-2026-41316.yml
+++ b/gems/erb/CVE-2026-41316.yml
@@ -32,4 +32,6 @@ related:
     - https://www.ruby-lang.org/en/news/2026/04/21/erb-cve-2026-41316
     - https://github.com/ruby/erb/blob/master/NEWS.md
     - https://github.com/ruby/erb/commit/9d017be4e375cdd058650ce528ee6adfead20cac
+    - https://github.com/ruby/ruby/pull/16776
+    - https://github.com/ruby/ruby/pull/16777
     - https://github.com/advisories/GHSA-q339-8rmv-2mhv
diff --git a/rubies/ruby/CVE-2026-41316.yml b/rubies/ruby/CVE-2026-41316.yml
index d55e68bc8f..85615d19de 100644
--- a/rubies/ruby/CVE-2026-41316.yml
+++ b/rubies/ruby/CVE-2026-41316.yml
@@ -30,4 +30,6 @@ related:
     - https://www.ruby-lang.org/en/news/2026/04/21/erb-cve-2026-41316
     - https://github.com/ruby/erb/blob/master/NEWS.md
     - https://github.com/ruby/erb/commit/9d017be4e375cdd058650ce528ee6adfead20cac
+    - https://github.com/ruby/ruby/pull/16776
+    - https://github.com/ruby/ruby/pull/16777
     - https://github.com/advisories/GHSA-q339-8rmv-2mhv