Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
23 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
This vulnerability has been assigned the CVE identifier CVE-2025-55193 Impact The ID passed to find or similar methods may be logged without escaping. If this is directly to the terminal it may include unescaped ANSI sequences. Releases The fixed releases are available at the normal locations. Credits Thanks to lio346 from Unit 515 of OPSWAT for reporting this vulnerability
Recommended action: Upgrade to 8.0.2.1, 7.2.2.2 or 7.1.5.2 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
There is a potential denial of service vulnerability present in ActiveRecord's PostgreSQL adapter. This has been assigned the CVE identifier CVE-2022-44566. Versions Affected: All. Not affected: None. Fixed Versions - 2.3.18.47 (Rails LTS, which is a paid service and not part of the rubygem) - 3.2.22.34 (Rails LTS, which is a paid service and not part of the rubygem) - 4.2.11.27 (Rails LTS, which is a paid service and not part of the rubygem) - 5.2.8.15 (Rails LTS, which is a paid service and not part of the rubygem) - 6.1.7.1 - 7.0.4.1 Impact In ActiveRecord < 7.0.4.1 and < 6.1.7.1, when a value outside the range for a 64bit signed integer is provided to the PostgreSQL connection adapter, it will treat the target column type as numeric. Comparing integer values against numeric values can result in a slow sequential scan resulting in potential Denial of Service. Releases The fixed releases are available at the normal locations. Workarounds Ensure that user supplied input which is…
Recommended action: Upgrade to 7.0.4.1 or 6.1.7.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
There is a possible vulnerability in ActiveRecord related to the sanitization of comments. This vulnerability has been assigned the CVE identifier CVE-2023-22794. Versions Affected: = 6.0.0 Not affected: < 6.0.0 Fixed Versions: 6.0.6.1, 6.1.7.1, 7.0.4.1 Impact Previously the implementation of escaping for comments was insufficient for If malicious user input is passed to either the annotate query method, the optimizerhints query method, or through the QueryLogs interface which automatically adds annotations, it may be sent to the database with insufficient sanitization and be able to inject SQL outside of the comment. In most cases these interfaces won’t be used with user input and users should avoid doing so. Example vulnerable code: Example vulnerable QueryLogs configuration (the default configuration is not vulnerable): All users running an affected release should either upgrade or use one of the workarounds immediately. Releases The FIXED releases are available at the normal…
Recommended action: Upgrade to 7.0.4.1, 6.1.7.1 or 6.0.6.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
7.0.3.16.1.6.15.2.8.16.0.5.1· Vendor fix available
Issue
When serialized columns that use YAML (the default) are deserialized, Rails uses YAML.unsafeload to convert the YAML data in to Ruby objects. If an attacker can manipulate data in the database (via means like SQL injection), then it may be possible for the attacker to escalate to an RCE. There are no feasible workarounds for this issue, but other coders (such as JSON) are not impacted.
Recommended action: Upgrade to 7.0.3.1, 6.1.6.1, 6.0.5.1 or 5.2.8.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The Active Record component in Ruby on Rails 2.3.x, 3.0.x, 3.1.x, and 3.2.x does not ensure that the declared data type of a database column is used during comparisons of input values to stored values in that column, which makes it easier for remote attackers to conduct data-type injection attacks against Ruby on Rails applications via a crafted value, as demonstrated by unintended interaction between the "typed XML" feature and a MySQL database.
Recommended action: Upgrade to 4.2.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The PostgreSQL adapter in Active Record before 6.1.2.1, 6.0.3.5, 5.2.4.5 suffers from a regular expression denial of service (REDoS) vulnerability. Carefully crafted input can cause the input validation in the money type of the PostgreSQL adapter in Active Record to spend too much time in a regular expression, resulting in the potential for a DoS attack. This only impacts Rails applications that are using PostgreSQL along with money type columns that take user input.
Recommended action: Upgrade to 6.1.2.1, 6.0.3.5 or 5.2.4.5 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The Active Record component in Ruby on Rails 3.0.x before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not properly implement the passing of request data to a where method in an ActiveRecord class, which allows remote attackers to conduct certain SQL injection attacks via nested query parameters that leverage unintended recursion, a related issue to CVE-2012-2695.
Recommended action: Upgrade to 3.2.4, 3.1.5 or 3.0.13 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Ruby on Rails 2.3.9 and 3.0.0 does not properly handle nested attributes, which allows remote attackers to modify arbitrary records by changing the names of parameters for form inputs.
Recommended action: Upgrade to 3.0.1 or 2.3.10 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Multiple SQL injection vulnerabilities in Ruby on Rails before 2.1.1 allow remote attackers to execute arbitrary SQL commands via the (1) :limit and (2) :offset parameters, related to ActiveRecord, ActiveSupport, ActiveResource, ActionPack, and ActionMailer.
Recommended action: Upgrade to 2.1.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Ruby on Rails 3.0.x before 3.0.4 does not ensure that arguments to the limit function specify integer values, which makes it easier for remote attackers to conduct SQL injection attacks via a non-numeric argument.
Recommended action: Upgrade to 3.0.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The Active Record component in Ruby on Rails efore 2.3.15, 3.0.x before 3.0.14, 3.1.x before 3.1.6, and 3.2.x before 3.2.6 does not properly implement the passing of request data to a where method in an ActiveRecord class, which allows remote attackers to conduct certain SQL injection attacks via nested query parameters that leverage improper handling of nested hashes, a related issue to CVE-2012-2661.
Recommended action: Upgrade to 3.2.6, 3.1.6, 3.0.14 or 2.3.15 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Multiple SQL injection vulnerabilities in the quotetablename method in the ActiveRecord adapters in activerecord/lib/activerecord/connectionadapters/ in Ruby on Rails before 2.3.13, 3.0.x before 3.0.10, and 3.1.x before 3.1.0.rc5 allow remote attackers to execute arbitrary SQL commands via a crafted column name.
Recommended action: Upgrade to 3.1.0.rc5, 3.0.10 or 2.3.13 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Ruby on Rails 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request, as demonstrated by certain "[nil]" values, a related issue to CVE-2012-2660 and CVE-2012-2694.
Recommended action: Upgrade to 3.2.11, 3.1.10 or 3.0.19 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
ActiveRecord in Ruby on Rails before 2.3.17, 3.1.x before 3.1.11, and 3.2.x before 3.2.12 allows remote attackers to bypass the attrprotected protection mechanism and modify protected model attributes via a crafted request.
Recommended action: Upgrade to 3.2.12, 3.1.11 or 2.3.17 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The Active Record component in Ruby on Rails 2.3.x before 2.3.18, 3.1.x before 3.1.12, and 3.2.x before 3.2.13 processes certain queries by converting hash keys to symbols, which allows remote attackers to cause a denial of service via crafted input to a where method.
Recommended action: Upgrade to 3.2.13, 3.1.12 or 2.3.18 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
SQL injection vulnerability in the Active Record component in Ruby on Rails before 2.3.15, 3.0.x before 3.0.18, 3.1.x before 3.1.9, and 3.2.x before 3.2.10 allows remote attackers to execute arbitrary SQL commands via a crafted request that leverages incorrect behavior of dynamic finders in applications that can use unexpected data types in certain findby method calls.
Recommended action: Upgrade to 3.2.10, 3.1.9, 3.0.18 or 2.3.15 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
ActiveRecord in Ruby on Rails before 2.3.17 and 3.x before 3.1.0 allows remote attackers to cause a denial of service or execute arbitrary code via crafted serialized attributes that cause the +serialize+ helper to deserialize arbitrary YAML.
Recommended action: Upgrade to 3.1.0 or 2.3.17 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
SQL injection vulnerability in activerecord/lib/activerecord/connectionadapters/postgresql/quoting.rb in the PostgreSQL adapter for Active Record in Ruby on Rails 4.x before 4.0.7 and 4.1.x before 4.1.3 allows remote attackers to execute arbitrary SQL commands by leveraging improper range quoting.
Recommended action: Upgrade to 4.1.3 or 4.0.7 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
5.0.0.beta1.13.2.22.14.1.14.14.2.5.1· Vendor fix available
Issue
activerecord/lib/activerecord/nestedattributes.rb in Active Record in Ruby on Rails 3.1.x and 3.2.x before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 does not properly implement a certain destroy option, which allows remote attackers to bypass intended change restrictions by leveraging use of the nested attributes feature.
Recommended action: Upgrade to 5.0.0.beta1.1, 4.2.5.1, 4.1.14.1 or 3.2.22.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
SQL injection vulnerability in activerecord/lib/activerecord/connectionadapters/postgresqladapter.rb in the PostgreSQL adapter for Active Record in Ruby on Rails 2.x and 3.x before 3.2.19 allows remote attackers to execute arbitrary SQL commands by leveraging improper bitstring quoting.
Recommended action: Upgrade to 3.2.19 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
activerecord/lib/activerecord/relation/querymethods.rb in Active Record in Ruby on Rails 4.0.x before 4.0.9 and 4.1.x before 4.1.5 allows remote attackers to bypass the strong parameters protection mechanism via crafted input to an application that makes createwith calls.
Recommended action: Upgrade to 4.1.5 or 4.0.9 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
SQL injection vulnerability in activerecord/lib/activerecord/connectionadapters/postgresql/cast.rb in Active Record in Ruby on Rails 4.0.x before 4.0.3, and 4.1.0.beta1, when PostgreSQL is used, allows remote attackers to execute "add data" SQL commands via vectors involving \ (backslash) characters that are not properly handled in operations on array columns.
Recommended action: Upgrade to 4.1.0.beta2 or 4.0.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Active Record in Ruby on Rails 4.2.x before 4.2.7.1 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request, as demonstrated by certain "[nil]" values, a related issue to CVE-2012-2660, CVE-2012-2694, and CVE-2013-0155.
Recommended action: Upgrade to 4.2.7.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.