- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 17 · 5 medium
- Registry
- RubyGems
Advisories 17
- CVE-2026-33176Medium 6.6
Rails Active Support has a possible DoS vulnerability in its number helpers
Affected: from 8.1.0.beta1, fixed in 8.1.2.1; from 8.0.0.beta1, fixed in 8.0.4.1; fixed in 7.2.3.1.
- CVE-2026-33170Medium 5.3
Rails Active Support has a possible XSS vulnerability in SafeBuffer#%
Affected: from 8.1.0.beta1, fixed in 8.1.2.1; from 8.0.0.beta1, fixed in 8.0.4.1; fixed in 7.2.3.1.
- CVE-2026-33169Medium 6.9
Rails Active Support has a possible ReDoS vulnerability in number_to_delimited
Affected: from 8.1.0.beta1, fixed in 8.1.2.1; from 8.0.0.beta1, fixed in 8.0.4.1; fixed in 7.2.3.1.
- CVE-2023-38037Medium 5.5
ActiveSupport::EncryptedFile writes contents that will be encrypted to a temporary file.
Affected: from 5.2.0, fixed in 6.1.7.5; from 7.0.0, fixed in 7.0.7.1.
- CVE-2023-28120Medium 5.3
There is a vulnerability in ActiveSupport if the new bytesplice method is called on a SafeBuffer with untrusted user input.
Affected: from 7.0.0, fixed in 7.0.4.3; fixed in 6.1.7.3.
- CVE-2023-22796Unrated
A regular expression based DoS vulnerability in Active Support <6.1.7.1 and <7.0.4.1.
Affected: fixed in 6.1.7.1; from 7.0.0, fixed in 7.0.4.1.
- CVE-2020-8165Unrated
A deserialization of untrusted data vulnernerability exists in rails < 5.2.4.3, rails < 6.0.3.1 that can allow an attacker to unmarshal…
Affected: from 5.0.0, fixed in 5.2.4.3; from 6.0.0, fixed in 6.0.3.1.
- CVE-2015-3227Unrated
The (1) jdom.rb and (2) rexml.rb components in Active Support in Ruby on Rails before 4.1.11 and 4.2.x before 4.2.2, when JDOM or REXML is…
Affected: from 4.0.0.beta1, fixed in 4.1.11; from 4.2.0.beta1, fixed in 4.2.2; fixed in 3.2.22.
- CVE-2015-3226Unrated
Cross-site scripting (XSS) vulnerability in json/encoding.rb in Active Support in Ruby on Rails 3.x and 4.1.x before 4.1.11 and 4.2.x…
Affected: from 4.1.0, fixed in 4.1.11; from 4.2.0, fixed in 4.2.2.
- CVE-2013-1856Unrated
The ActiveSupport::XmlMini_JDOM backend in lib/active_support/xml_mini/jdom.rb in the Active Support component in Ruby on Rails 3.0.x and…
Affected: from 3.0.0, fixed in 3.1.12; from 3.2.0, fixed in 3.2.13.
- CVE-2013-0333Unrated
lib/active_support/json/backends/yaml.rb in Ruby on Rails 2.3.x before 2.3.16 and 3.0.x before 3.0.20 does not properly convert JSON data…
Affected: from 2.3.2, fixed in 2.3.16; from 3.0.0, fixed in 3.0.20.
- CVE-2012-3464Unrated
Cross-site scripting (XSS) vulnerability in activesupport/lib/active_support/core_ext/string/output_safety.rb in Ruby on Rails before…
Affected: from 3.0.0.beta, fixed in 3.0.17; from 3.1.0, fixed in 3.1.8; from 3.2.0, fixed in 3.2.8; fixed in 2.3.16.
- CVE-2012-1098Unrated
Cross-site scripting (XSS) vulnerability in Ruby on Rails 3.0.x before 3.0.12, 3.1.x before 3.1.4, and 3.2.x before 3.2.2 allows remote…
Affected: from 3.0.0, fixed in 3.0.12; from 3.1.0, fixed in 3.1.4; from 3.2.0, fixed in 3.2.2.
- CVE-2011-2932Unrated
Cross-site scripting (XSS) vulnerability in activesupport/lib/active_support/core_ext/string/output_safety.rb in Ruby on Rails 2.x before…
Affected: from 2.0.0, fixed in 2.3.13; from 3.0.0, fixed in 3.0.10.
- CVE-2011-2197Unrated
The cross-site scripting (XSS) prevention feature in Ruby on Rails 2.x before 2.3.12, 3.0.x before 3.0.8, and 3.1.x before 3.1.0.rc2 does…
Affected: from 2.0.0, fixed in 2.3.12; from 3.0.0, fixed in 3.0.8.
Show all 17 advisoriesShow fewer advisories
- CVE-2009-3086Unrated
A certain algorithm in Ruby on Rails 2.1.0 through 2.2.2, and 2.3.x before 2.3.4, leaks information about the complexity of message-digest…
Affected: from 2.1.0, fixed in 2.2.3; from 2.3.0, fixed in 2.3.4.
- CVE-2009-3009Unrated
Cross-site scripting (XSS) vulnerability in Ruby on Rails 2.x before 2.2.3, and 2.3.x before 2.3.4, allows remote attackers to inject…
Affected: from 2.0.0, fixed in 2.2.3; from 2.3.0, fixed in 2.3.4.