ActiveSupport potentially unintended unmarshalling of user-provided objects in MemCacheStore and RedisCacheStore

Exploitation

No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.

CVSS

9.8 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

• CVE-2020-8165: 45.73% estimated exploitation activity in the next 30 days; percentile 98.80 (FIRST EPSS, 2026-11-03). This is a model estimate, not proof of exploitation or customer exposure.

As published by the source; long descriptions are shortened.

In ActiveSupport, there is potentially unexpected behaviour in the MemCacheStore and RedisCacheStore where, when untrusted user input is written to the cache store using the raw: true parameter, re-reading the result from the cache can evaluate the user input as a Marshalled object instead of plain text. Vulnerable code looks like: Versions Affected: rails < 5.2.5, rails < 6.0.4 Not affected: Applications not using MemCacheStore or RedisCacheStore. Applications that do not use the raw option when storing untrusted user input. Fixed Versions: rails = 5.2.4.3, rails = 6.0.3.1 Impact ------ Unmarshalling of untrusted user input can have impact up to and including RCE. At a minimum, this vulnerability allows an attacker to inject untrusted Ruby objects into a web application. In addition to upgrading to the latest versions of Rails, developers should ensure that whenever they are calling Rails.cache.fetch they are using consistent values of the raw parameter for both reading and writing,…

Published by the source

26 May 2020, 14:49 UTC

Last modified by the source

9 May 2025, 21:34 UTC

Source last checked

26 Oct 2026, 15:49 UTC

1. Revision 1 · created · 26 Oct 2026

   Published from ghsa record GHSA-2p68-f74v-9wc6

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: CVE-2020-8165

Advisory: ActiveSupport potentially unintended unmarshalling of user-provided objects in MemCacheStore and RedisCacheStore
IDs: CVE-2020-8165, GHSA-2p68-f74v-9wc6
Record: https://patchnext.com/advisories/cve-2020-8165 (revision 1, source checked 26 Oct 2026, 15:49 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: Critical (CVSS 9.8)
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Vendor fix available; fixed versions by package: activesupport 6.0.3.1, 5.2.4.3. A vendor fix does not mean a deployment is fixed.

## Affected components
- RubyGems activesupport: affected >= 5.0.0, <= 5.2.4.2; >= 6.0.0, <= 6.0.3; fixed in 6.0.3.1, 5.2.4.3

## Suggested inspection (read-only)
- RubyGems activesupport: check the installed version with your package manager.

## Supported action
Upgrade each affected component to a fixed version on its release line. For a transitive dependency, upgrade the parent package or add an override or constraint, then regenerate the lockfile. Redeploy every environment that ran an affected version.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on activesupport.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://github.com/advisories/GHSA-2p68-f74v-9wc6 (GitHub-reviewed advisory GHSA-2p68-f74v-9wc6 lists affected ranges: RubyGems activesupport >=5.0.0 =6.0.0 <=6.0.3)

Commands are suggestions: review each one before running it.