# activesupport (RubyGems) vulnerabilities 17 known vulnerabilities (5 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: not known (cve.now hasn't read this package's releases) - Newest unaffected release: not known without release data - Registry: https://rubygems.org/gems/activesupport ## Advisories (17) ### [CVE-2026-33176](https://cve.now/CVE-2026-33176): Rails Active Support has a possible DoS vulnerability in its number helpers - Severity: Medium 6.6 - Published: Mar 23, 2026 - Affected: from 8.1.0.beta1, fixed in 8.1.2.1; from 8.0.0.beta1, fixed in 8.0.4.1; fixed in 7.2.3.1. ### [CVE-2026-33170](https://cve.now/CVE-2026-33170): Rails Active Support has a possible XSS vulnerability in SafeBuffer#% - Severity: Medium 5.3 - Published: Mar 23, 2026 - Affected: from 8.1.0.beta1, fixed in 8.1.2.1; from 8.0.0.beta1, fixed in 8.0.4.1; fixed in 7.2.3.1. ### [CVE-2026-33169](https://cve.now/CVE-2026-33169): Rails Active Support has a possible ReDoS vulnerability in number\_to\_delimited - Severity: Medium 6.9 - Published: Mar 23, 2026 - Affected: from 8.1.0.beta1, fixed in 8.1.2.1; from 8.0.0.beta1, fixed in 8.0.4.1; fixed in 7.2.3.1. ### [CVE-2023-38037](https://cve.now/CVE-2023-38037): ActiveSupport::EncryptedFile writes contents that will be encrypted to a temporary file. - Severity: Medium 5.5 - Published: Jan 9, 2025 - Affected: from 5.2.0, fixed in 6.1.7.5; from 7.0.0, fixed in 7.0.7.1. ### [CVE-2023-28120](https://cve.now/CVE-2023-28120): There is a vulnerability in ActiveSupport if the new bytesplice method is called on a SafeBuffer with untrusted user input. - Severity: Medium 5.3 - Published: Jan 9, 2025 - Affected: from 7.0.0, fixed in 7.0.4.3; fixed in 6.1.7.3. ### [CVE-2023-22796](https://cve.now/CVE-2023-22796): A regular expression based DoS vulnerability in Active Support \<6.1.7.1 and \<7.0.4.1. - Severity: Unrated - Published: Feb 9, 2023 - Affected: fixed in 6.1.7.1; from 7.0.0, fixed in 7.0.4.1. ### [CVE-2020-8165](https://cve.now/CVE-2020-8165): A deserialization of untrusted data vulnernerability exists in rails \< 5.2.4.3, rails \< 6.0.3.1 that can allow an attacker to unmarshal… - Severity: Unrated - Published: Jun 19, 2020 - Affected: from 5.0.0, fixed in 5.2.4.3; from 6.0.0, fixed in 6.0.3.1. ### [CVE-2015-3227](https://cve.now/CVE-2015-3227): The (1) jdom.rb and (2) rexml.rb components in Active Support in Ruby on Rails before 4.1.11 and 4.2.x before 4.2.2, when JDOM or REXML is… - Severity: Unrated - Published: Jul 26, 2015 - Affected: from 4.0.0.beta1, fixed in 4.1.11; from 4.2.0.beta1, fixed in 4.2.2; fixed in 3.2.22. ### [CVE-2015-3226](https://cve.now/CVE-2015-3226): Cross-site scripting (XSS) vulnerability in json/encoding.rb in Active Support in Ruby on Rails 3.x and 4.1.x before 4.1.11 and 4.2.x… - Severity: Unrated - Published: Jul 26, 2015 - Affected: from 4.1.0, fixed in 4.1.11; from 4.2.0, fixed in 4.2.2. ### [CVE-2013-1856](https://cve.now/CVE-2013-1856): The ActiveSupport::XmlMini\_JDOM backend in lib/active\_support/xml\_mini/jdom.rb in the Active Support component in Ruby on Rails 3.0.x and… - Severity: Unrated - Published: Mar 19, 2013 - Affected: from 3.0.0, fixed in 3.1.12; from 3.2.0, fixed in 3.2.13. ### [CVE-2013-0333](https://cve.now/CVE-2013-0333): lib/active\_support/json/backends/yaml.rb in Ruby on Rails 2.3.x before 2.3.16 and 3.0.x before 3.0.20 does not properly convert JSON data… - Severity: Unrated - Published: Jan 30, 2013 - Affected: from 2.3.2, fixed in 2.3.16; from 3.0.0, fixed in 3.0.20. ### [CVE-2012-3464](https://cve.now/CVE-2012-3464): Cross-site scripting (XSS) vulnerability in activesupport/lib/active\_support/core\_ext/string/output\_safety.rb in Ruby on Rails before… - Severity: Unrated - Published: Aug 10, 2012 - Affected: from 3.0.0.beta, fixed in 3.0.17; from 3.1.0, fixed in 3.1.8; from 3.2.0, fixed in 3.2.8; fixed in 2.3.16. ### [CVE-2012-1098](https://cve.now/CVE-2012-1098): Cross-site scripting (XSS) vulnerability in Ruby on Rails 3.0.x before 3.0.12, 3.1.x before 3.1.4, and 3.2.x before 3.2.2 allows remote… - Severity: Unrated - Published: Mar 13, 2012 - Affected: from 3.0.0, fixed in 3.0.12; from 3.1.0, fixed in 3.1.4; from 3.2.0, fixed in 3.2.2. ### [CVE-2011-2932](https://cve.now/CVE-2011-2932): Cross-site scripting (XSS) vulnerability in activesupport/lib/active\_support/core\_ext/string/output\_safety.rb in Ruby on Rails 2.x before… - Severity: Unrated - Published: Aug 29, 2011 - Affected: from 2.0.0, fixed in 2.3.13; from 3.0.0, fixed in 3.0.10. ### [CVE-2011-2197](https://cve.now/CVE-2011-2197): The cross-site scripting (XSS) prevention feature in Ruby on Rails 2.x before 2.3.12, 3.0.x before 3.0.8, and 3.1.x before 3.1.0.rc2 does… - Severity: Unrated - Published: Jun 30, 2011 - Affected: from 2.0.0, fixed in 2.3.12; from 3.0.0, fixed in 3.0.8. ### [CVE-2009-3086](https://cve.now/CVE-2009-3086): A certain algorithm in Ruby on Rails 2.1.0 through 2.2.2, and 2.3.x before 2.3.4, leaks information about the complexity of message-digest… - Severity: Unrated - Published: Sep 8, 2009 - Affected: from 2.1.0, fixed in 2.2.3; from 2.3.0, fixed in 2.3.4. ### [CVE-2009-3009](https://cve.now/CVE-2009-3009): Cross-site scripting (XSS) vulnerability in Ruby on Rails 2.x before 2.2.3, and 2.3.x before 2.3.4, allows remote attackers to inject… - Severity: Unrated - Published: Sep 8, 2009 - Affected: from 2.0.0, fixed in 2.2.3; from 2.3.0, fixed in 2.3.4. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/rubygems/activesupport Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.