# activerecord (RubyGems) vulnerabilities 23 known vulnerabilities (1 critical, 1 high, 1 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: not known (cve.now hasn't read this package's releases) - Newest unaffected release: not known without release data - Registry: https://rubygems.org/gems/activerecord ## Advisories (23) ### [CVE-2025-55193](https://cve.now/CVE-2025-55193): Active Record logging vulnerable to ANSI escape injection - Severity: Low 2.7 - Published: Aug 13, 2025 - Affected: from 8.0, fixed in 8.0.2.1; from 7.2, fixed in 7.2.2.2; fixed in 7.1.5.2. ### [CVE-2023-22794](https://cve.now/CVE-2023-22794): A vulnerability in ActiveRecord \<6.0.6.1, v6.1.7.1 and v7.0.4.1 related to the sanitization of comments. - Severity: Unrated - Published: Feb 9, 2023 - Affected: from 6.0.0, fixed in 6.0.6.1; from 6.1.0, fixed in 6.1.7.1; from 7.0.0, fixed in 7.0.4.1. ### [CVE-2022-44566](https://cve.now/CVE-2022-44566): A denial of service vulnerability present in ActiveRecord's PostgreSQL adapter \<7.0.4.1 and \<6.1.7.1. - Severity: High 7.5 - Published: Feb 9, 2023 - Affected: fixed in 6.1.7.1; from 7.0.0, fixed in 7.0.4.1. ### [CVE-2022-32224](https://cve.now/CVE-2022-32224): A possible escalation to RCE vulnerability exists when using YAML serialized columns in Active Record \< 7.0.3.1, \<6.1.6.1, \<6.0.5.1 and… - Severity: Critical 9.8 - Published: Dec 5, 2022 - Affected: from 7.0.0, fixed in 7.0.3.1; from 6.1.0, fixed in 6.1.6.1; from 6.0.0, fixed in 6.0.5.1; fixed in 5.2.8.1. ### [CVE-2021-22880](https://cve.now/CVE-2021-22880): The PostgreSQL adapter in Active Record before 6.1.2.1, 6.0.3.5, 5.2.4.5 suffers from a regular expression denial of service (REDoS)… - Severity: Unrated - Published: Feb 11, 2021 - Affected: from 5.0.0, fixed in 5.2.4.5; from 6.0.0, fixed in 6.0.3.5; from 6.1.0, fixed in 6.1.2.1. ### [CVE-2016-6317](https://cve.now/CVE-2016-6317): Action Record in Ruby on Rails 4.2.x before 4.2.7.1 does not properly consider differences in parameter handling between the Active Record… - Severity: Unrated - Published: Sep 7, 2016 - Affected: from 4.2.0, fixed in 4.2.7.1. ### [CVE-2015-7577](https://cve.now/CVE-2015-7577): activerecord/lib/active\_record/nested\_attributes.rb in Active Record in Ruby on Rails 3.1.x and 3.2.x before 3.2.22.1, 4.0.x and 4.1.x… - Severity: Unrated - Published: Feb 16, 2016 - Affected: from 3.1.0, fixed in 3.2.22.1; from 4.0.0, fixed in 4.1.14.1; from 4.2.0, fixed in 4.2.5.1; from 5.0.0.beta1, fixed in 5.0.0.beta1.1. ### [CVE-2014-3514](https://cve.now/CVE-2014-3514): activerecord/lib/active\_record/relation/query\_methods.rb in Active Record in Ruby on Rails 4.0.x before 4.0.9 and 4.1.x before 4.1.5… - Severity: Unrated - Published: Aug 20, 2014 - Affected: from 4.0.0, fixed in 4.0.9; from 4.1.0, fixed in 4.1.5. ### [CVE-2014-3483](https://cve.now/CVE-2014-3483): SQL injection vulnerability in activerecord/lib/active\_record/connection\_adapters/postgresql/quoting.rb in the PostgreSQL adapter for… - Severity: Unrated - Published: Jul 7, 2014 - Affected: from 4.0.0, fixed in 4.0.7; from 4.1.0, fixed in 4.1.3. ### [CVE-2014-3482](https://cve.now/CVE-2014-3482): SQL injection vulnerability in activerecord/lib/active\_record/connection\_adapters/postgresql\_adapter.rb in the PostgreSQL adapter for… - Severity: Unrated - Published: Jul 7, 2014 - Affected: from 2.0.0, fixed in 3.2.19. ### [CVE-2014-0080](https://cve.now/CVE-2014-0080): SQL injection vulnerability in activerecord/lib/active\_record/connection\_adapters/postgresql/cast.rb in Active Record in Ruby on Rails… - Severity: Unrated - Published: Feb 20, 2014 - Affected: from 4.0.0, fixed in 4.0.3; from 4.1.0.beta1, fixed in 4.1.0.beta2. ### [CVE-2013-3221](https://cve.now/CVE-2013-3221): The Active Record component in Ruby on Rails 2.3.x, 3.0.x, 3.1.x, and 3.2.x does not ensure that the declared data type of a database… - Severity: Unrated - Published: Apr 22, 2013 - Affected: fixed in 4.2.0. ### [CVE-2013-1854](https://cve.now/CVE-2013-1854): The Active Record component in Ruby on Rails 2.3.x before 2.3.18, 3.1.x before 3.1.12, and 3.2.x before 3.2.13 processes certain queries… - Severity: Unrated - Published: Mar 19, 2013 - Affected: from 2.3.0, fixed in 2.3.18; from 3.1.0, fixed in 3.1.12; from 3.2.0, fixed in 3.2.13. ### [CVE-2013-0277](https://cve.now/CVE-2013-0277): ActiveRecord in Ruby on Rails before 2.3.17 and 3.x before 3.1.0 allows remote attackers to cause a denial of service or execute arbitrary… - Severity: Unrated - Published: Feb 13, 2013 - Affected: fixed in 2.3.17; from 3.0.0, fixed in 3.1.0. ### [CVE-2013-0276](https://cve.now/CVE-2013-0276): ActiveRecord in Ruby on Rails before 2.3.17, 3.1.x before 3.1.11, and 3.2.x before 3.2.12 allows remote attackers to bypass the… - Severity: Unrated - Published: Feb 13, 2013 - Affected: fixed in 2.3.17; from 3.1.0, fixed in 3.1.11; from 3.2.0, fixed in 3.2.12. ### [CVE-2013-0155](https://cve.now/CVE-2013-0155): Ruby on Rails 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly consider differences in parameter… - Severity: Unrated - Published: Jan 13, 2013 - Affected: from 3.0.0, fixed in 3.0.19; from 3.1.0, fixed in 3.1.10; from 3.2.0, fixed in 3.2.11. ### [CVE-2012-6496](https://cve.now/CVE-2012-6496): SQL injection vulnerability in the Active Record component in Ruby on Rails before 3.0.18, 3.1.x before 3.1.9, and 3.2.x before 3.2.10… - Severity: Unrated - Published: Jan 4, 2013 - Affected: from 3.0.0.beta, fixed in 3.0.18; from 3.1.0, fixed in 3.1.9; from 3.2.0, fixed in 3.2.10; fixed in 2.3.15. ### [CVE-2012-2695](https://cve.now/CVE-2012-2695): The Active Record component in Ruby on Rails before 3.0.14, 3.1.x before 3.1.6, and 3.2.x before 3.2.6 does not properly implement the… - Severity: Unrated - Published: Jun 22, 2012 - Affected: from 3.0.0.beta, fixed in 3.0.14; from 3.1.0, fixed in 3.1.6; from 3.2.0, fixed in 3.2.6; fixed in 2.3.15. ### [CVE-2012-2661](https://cve.now/CVE-2012-2661): The Active Record component in Ruby on Rails 3.0.x before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not properly implement… - Severity: Unrated - Published: Jun 22, 2012 - Affected: from 3.0.0, fixed in 3.0.13; from 3.1.0, fixed in 3.1.5; from 3.2.0, fixed in 3.2.4. ### [CVE-2011-2930](https://cve.now/CVE-2011-2930): Multiple SQL injection vulnerabilities in the quote\_table\_name method in the ActiveRecord adapters in… - Severity: Unrated - Published: Aug 29, 2011 - Affected: from 2.0.0, fixed in 2.3.13; from 3.0.0.beta, fixed in 3.0.10; from 3.1.0.beta1, fixed in 3.1.0.rc5. ### [CVE-2011-0448](https://cve.now/CVE-2011-0448): Ruby on Rails 3.0.x before 3.0.4 does not ensure that arguments to the limit function specify integer values, which makes it easier for… - Severity: Unrated - Published: Feb 21, 2011 - Affected: from 3.0.0, fixed in 3.0.4. ### [CVE-2010-3933](https://cve.now/CVE-2010-3933): Ruby on Rails 2.3.9 and 3.0.0 does not properly handle nested attributes, which allows remote attackers to modify arbitrary records by… - Severity: Unrated - Published: Oct 27, 2010 - Affected: from 2.3.9, fixed in 2.3.10; from 3.0.0, fixed in 3.0.1. ### [CVE-2008-4094](https://cve.now/CVE-2008-4094): Multiple SQL injection vulnerabilities in Ruby on Rails before 2.1.1 allow remote attackers to execute arbitrary SQL commands via the (1)… - Severity: Unrated - Published: Sep 30, 2008 - Affected: fixed in 2.1.1. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/rubygems/activerecord Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.