Ruby on Rails vulnerabilities
The newest vulnerabilities affecting Ruby on Rails, up to 200. Subscribe by RSS.
- CVE-2026-81097rails-mcp-server 1.4.0 through 1.6.0 OS Command Execution via execute_ruby PTY Escapemaquina-app rails-mcp-server
- CVE-2026-73648rails-html-sanitizer: Possible XSS vulnerability with certain configurationsrails-html-sanitizer
- CVE-2026-66066Action Pack: Possible arbitrary file read and remote code execution in Active Storage variant processingrails · activestorage
- CVE-2026-33176Rails Active Support has a possible DoS vulnerability in its number helpersrails activesupport · activesupport
- CVE-2026-33170Rails Active Support has a possible XSS vulnerability in SafeBuffer#%rails activesupport · activesupport
- CVE-2026-33169Rails Active Support has a possible ReDoS vulnerability in number_to_delimitedrails activesupport · activesupport
- CVE-2026-33167Rails has a possible XSS vulnerability in its Action Pack debug exceptionsrails actionpack · actionpack
- CVE-2025-55193Active Record logging vulnerable to ANSI escape injectionrails · activerecord
- CVE-2023-23913There is a potential DOM based cross-site scripting issue in rails-ujs which leverages the Clipboard API to target HTML elements that are asrails-ujs · actionview
- CVE-2023-28362The redirect_to method in Rails allows provided values to contain characters which are not legal in an HTTP header value.Rails Action Pack · actionpack
- CVE-2023-38037ActiveSupport::EncryptedFile writes contents that will be encrypted to a temporary file.Rails ActiveSupport · activesupport
- CVE-2023-28120There is a vulnerability in ActiveSupport if the new bytesplice method is called on a SafeBuffer with untrusted user input.Rails ActiveSupport · activesupport
- CVE-2024-54133Possible Content Security Policy bypass in Action Dispatchrails · actionpack
- CVE-2024-53985Possible XSS vulnerability with certain configurations of rails-html-sanitizer 1.6.0rails-html-sanitizer
- CVE-2024-53987Possible XSS vulnerability with certain configurations of rails-html-sanitizer 1.6.0rails-html-sanitizer
- CVE-2024-53986Possible XSS vulnerability with certain configurations of rails-html-sanitizer 1.6.0rails-html-sanitizer
- CVE-2024-53988Possible XSS vulnerability with certain configurations of rails-html-sanitizer 1.6.0rails-html-sanitizer
- CVE-2024-53989Possible XSS vulnerability with certain configurations of rails-html-sanitizer 1.6.0rails-html-sanitizer
- CVE-2024-47889Action Mailer has possible ReDoS vulnerability in block_formatrails · actionmailer
- CVE-2024-47888Action Text has possible ReDoS vulnerability in plain_text_for_blockquote_noderails · actiontext
- CVE-2024-47887Action Controller has possible ReDoS vulnerability in HTTP Token authenticationrails · actionpack
- CVE-2024-41128Action Dispatch has possible ReDoS vulnerability in query parameter filteringrails · actionpack
- CVE-2024-39308RailsAdmin Cross-site Scripting vulnerability in the list viewrailsadminteam rails_admin · rails_admin
- CVE-2024-32464ActionText ContentAttachment can Contain Unsanitized HTMLrails · actiontext
- CVE-2024-28103Action Pack is missing security headers on non-HTML responsesrails · actionpack
- CVE-2024-26144Possible Sensitive Session Information Leak in Active Storagerails · activestorage
- CVE-2024-26143Rails Possible XSS Vulnerability in Action Controllerrails · actionpack
- CVE-2024-26142Rails possible ReDoS vulnerability in Accept header parsing in Action Dispatchrails · actionpack
- CVE-2022-44566A denial of service vulnerability present in ActiveRecord's PostgreSQL adapter <7.0.4.1 and <6.1.7.1.https://github.com/rails/rails · activerecord
- CVE-2023-22792A regular expression based DoS vulnerability in Action Dispatch <6.0.6.1,< 6.1.7.1, and <7.0.4.1.https://github.com/rails/rails · actionpack
- CVE-2023-22794A vulnerability in ActiveRecord <6.0.6.1, v6.1.7.1 and v7.0.4.1 related to the sanitization of comments.https://github.com/rails/rails · activerecord
- CVE-2023-22795A regular expression based DoS vulnerability in Action Dispatch <6.1.7.1 and <7.0.4.1 related to the If-None-Match header.https://github.com/rails/rails · actionpack
- CVE-2023-22796A regular expression based DoS vulnerability in Active Support <6.1.7.1 and <7.0.4.1.https://github.com/rails/rails · activesupport
- CVE-2023-22797An open redirect vulnerability is fixed in Rails 7.0.4.1 with the new protection against open redirects from calling redirect_to with untrushttps://github.com/rails/rails · actionpack
- CVE-2014-125033rails-cv-app uploaded_files_controller.rb path traversalrails-cv-app
- CVE-2022-23520rails-html-sanitizer contains an incomplete fix for an XSS vulnerabilityrails-html-sanitizer
- CVE-2022-23519Possible XSS vulnerability with certain configurations of rails-html-sanitizerrails-html-sanitizer
- CVE-2022-23518Improper neutralization of data URIs allows XSS in rails-html-sanitizerrails-html-sanitizer
- CVE-2022-23517Inefficient Regular Expression Complexity in rails-html-sanitizerrails-html-sanitizer
- CVE-2022-32224A possible escalation to RCE vulnerability exists when using YAML serialized columns in Active Record < 7.0.3.1, <6.1.6.1, <6.0.5.1 and <5.2https://github.com/rails/rails · activerecord
- CVE-2022-3704Ruby on Rails _table.html.erb cross site scriptingRuby on Rails
- CVE-2022-22577An XSS Vulnerability in Action Pack >= 5.2.0 and < 5.2.0 that could allow an attacker to bypass CSP for non HTML like responses.https://github.com/rails/rails · actionpack
- CVE-2022-23633Exposure of sensitive information in Action Packrails · actionpack
- CVE-2021-44528A open redirect vulnerability exists in Action Pack >= 6.0.0 that could allow an attacker to craft a "X-Forwarded-Host" headers in combinatihttps://github.com/rails/rails · actionpack
- CVE-2021-41263Secure/signed cookies share secrets between sites in rails_multisitediscourse rails_multisite · rails_multisite
- CVE-2011-1497A cross-site scripting vulnerability flaw was found in the auto_link function in Rails before version 3.0.6.rails · actionpack
- CVE-2021-22942A possible open redirect vulnerability in the Host Authorization middleware in Action Pack >= 6.0.0 that could allow attackers to redirect uhttps://github.com/rails/rails · actionpack
- CVE-2021-22902The actionpack ruby gem (a framework for handling and responding to web requests in Rails) before 6.0.3.7, 6.1.3.2 suffers from a possible dhttps://github.com/rails/rails · actionpack
- CVE-2021-22903The actionpack ruby gem before 6.1.3.2 suffers from a possible open redirect vulnerability.https://github.com/rails/rails · actionpack
- CVE-2021-22904The actionpack ruby gem before 6.1.3.2, 6.0.3.7, 5.2.4.6, 5.2.6 suffers from a possible denial of service vulnerability in the Token Authenthttps://github.com/rails/rails · actionpack
- CVE-2021-22885A possible information disclosure / unintended method execution vulnerability in Action Pack >= 2.0.0 when using the `redirect_to` or `polymhttps://github.com/rails/rails · actionpack
- CVE-2021-22881The Host Authorization middleware in Action Pack before 6.1.2.1, 6.0.3.5 suffers from an open redirect vulnerability.https://github.com/rails/rails · actionpack
- CVE-2021-22880The PostgreSQL adapter in Active Record before 6.1.2.1, 6.0.3.5, 5.2.4.5 suffers from a regular expression denial of service (REDoS) vulnerahttps://github.com/rails/rails · activerecord
- CVE-2020-8264In actionpack gem >= 6.0.0, a possible XSS vulnerability exists when an application is running in development mode allowing an attacker to shttps://github.com/rails/rails · actionpack
- CVE-2020-8166A CSRF forgery vulnerability exists in rails < 5.2.5, rails < 6.0.4 that makes it possible for an attacker to, given a global CSRF token suchttps://github.com/rails/rails · actionpack
- CVE-2020-8185A denial of service vulnerability exists in Rails <6.0.3.2 that allowed an untrusted user to run any pending migrations on a Rails app runnihttps://github.com/rails/rails · actionpack
- CVE-2020-8165A deserialization of untrusted data vulnernerability exists in rails < 5.2.4.3, rails < 6.0.3.1 that can allow an attacker to unmarshal userhttps://github.com/rails/rails · activesupport
- CVE-2020-8164A deserialization of untrusted data vulnerability exists in rails < 5.2.4.3, rails < 6.0.3.1 which can allow an attacker to supply informatihttps://github.com/rails/rails · actionpack
- CVE-2010-3299The encrypt/decrypt functions in Ruby on Rails 2.3 are vulnerable to padding oracle attacks.rails
- CVE-2016-10522rails_admin ruby gem <v1.1.1 is vulnerable to cross-site request forgery (CSRF) attacks.https://github.com/sferik rails_admin ruby gem · rails_admin
- CVE-2018-3741There is a possible XSS vulnerability in all rails-html-sanitizer gem versions below 1.0.4 for Ruby.rails-html-sanitizer
- CVE-2016-6317Action Record in Ruby on Rails 4.2.x before 4.2.7.1 does not properly consider differences in parameter handling between the Active Record cactiverecord
- CVE-2016-2097Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.2 and 4.x before 4.1.14.2 allows remote attackers to read aractionview · actionpack
- CVE-2016-2098Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary Rubactionpack
- CVE-2015-7576The http_basic_authenticate_with method in actionpack/lib/action_controller/metal/http_authentication.rb in the Basic Authentication implemeactionpack
- CVE-2015-7577activerecord/lib/active_record/nested_attributes.rb in Active Record in Ruby on Rails 3.1.x and 3.2.x before 3.2.22.1, 4.0.x and 4.1.x beforactiverecord
- CVE-2015-7581actionpack/lib/action_dispatch/routing/route_set.rb in Action Pack in Ruby on Rails 4.x before 4.2.5.1 and 5.x before 5.0.0.beta1.1 allows ractionpack
- CVE-2016-0751actionpack/lib/action_dispatch/http/mime_type.rb in Action Pack in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x befactionpack
- CVE-2016-0752Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, anactionview · actionpack
- CVE-2015-3226Cross-site scripting (XSS) vulnerability in json/encoding.rb in Active Support in Ruby on Rails 3.x and 4.1.x before 4.1.11 and 4.2.x beforeactivesupport
- CVE-2015-3227The (1) jdom.rb and (2) rexml.rb components in Active Support in Ruby on Rails before 4.1.11 and 4.2.x before 4.2.2, when JDOM or REXML is eactivesupport
- CVE-2014-7829Directory traversal vulnerability in actionpack/lib/action_dispatch/middleware/static.rb in Action Pack in Ruby on Rails 3.x before 3.2.21, actionpack
- CVE-2014-7818Directory traversal vulnerability in actionpack/lib/action_dispatch/middleware/static.rb in Action Pack in Ruby on Rails 3.x before 3.2.20, actionpack
- CVE-2014-3514activerecord/lib/active_record/relation/query_methods.rb in Active Record in Ruby on Rails 4.0.x before 4.0.9 and 4.1.x before 4.1.5 allows activerecord
- CVE-2014-3482SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql_adapter.rb in the PostgreSQL adapter for Activeactiverecord
- CVE-2014-3483SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql/quoting.rb in the PostgreSQL adapter for Activeactiverecord
- CVE-2014-0130Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails beforactionpack
- CVE-2014-0080SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql/cast.rb in Active Record in Ruby on Rails 4.0.xactiverecord
- CVE-2014-0081Multiple cross-site scripting (XSS) vulnerabilities in actionview/lib/action_view/helpers/number_helper.rb in Ruby on Rails before 3.2.17, 4rails · actionpack
- CVE-2014-0082actionpack/lib/action_view/template/text.rb in Action View in Ruby on Rails 3.x before 3.2.17 converts MIME type strings to symbols during uactionpack
- CVE-2013-4491Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/translation_helper.rb in the internationalization component iactionpack
- CVE-2013-6414actionpack/lib/action_view/lookup_context.rb in Action View in Ruby on Rails 3.x before 3.2.16 and 4.x before 4.0.2 allows remote attackers actionpack
- CVE-2013-6415Cross-site scripting (XSS) vulnerability in the number_to_currency helper in actionpack/lib/action_view/helpers/number_helper.rb in Ruby on actionpack
- CVE-2013-6416Cross-site scripting (XSS) vulnerability in the simple_format helper in actionpack/lib/action_view/helpers/text_helper.rb in Ruby on Rails 4actionpack
- CVE-2013-6417actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.2.16 and 4.x before 4.0.2 does not properly consider differences inactionpack
- CVE-2013-3221The Active Record component in Ruby on Rails 2.3.x, 3.0.x, 3.1.x, and 3.2.x does not ensure that the declared data type of a database columnactiverecord
- CVE-2013-1854The Active Record component in Ruby on Rails 2.3.x before 2.3.18, 3.1.x before 3.1.12, and 3.2.x before 3.2.13 processes certain queries by activerecord
- CVE-2013-1855The sanitize_css method in lib/action_controller/vendor/html-scanner/html/sanitizer.rb in the Action Pack component in Ruby on Rails before actionpack
- CVE-2013-1856The ActiveSupport::XmlMini_JDOM backend in lib/active_support/xml_mini/jdom.rb in the Active Support component in Ruby on Rails 3.0.x and 3.activesupport
- CVE-2013-1857The sanitize helper in lib/action_controller/vendor/html-scanner/html/sanitizer.rb in the Action Pack component in Ruby on Rails before 2.3.actionpack
- CVE-2013-0276ActiveRecord in Ruby on Rails before 2.3.17, 3.1.x before 3.1.11, and 3.2.x before 3.2.12 allows remote attackers to bypass the attr_protectactiverecord
- CVE-2013-0277ActiveRecord in Ruby on Rails before 2.3.17 and 3.x before 3.1.0 allows remote attackers to cause a denial of service or execute arbitrary cactiverecord
- CVE-2013-0333lib/active_support/json/backends/yaml.rb in Ruby on Rails 2.3.x before 2.3.16 and 3.0.x before 3.0.20 does not properly convert JSON data toactivesupport
- CVE-2013-0155Ruby on Rails 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly consider differences in parameter handlingactiverecord
- CVE-2013-0156active_support/core_ext/hash/conversions.rb in Ruby on Rails before 2.3.15, 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.1actionpack
- CVE-2012-6496SQL injection vulnerability in the Active Record component in Ruby on Rails before 3.0.18, 3.1.x before 3.1.9, and 3.2.x before 3.2.10 allowactiverecord
- CVE-2012-3463Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/form_tag_helper.rb in Ruby on Rails 3.x before 3.0.17, 3.1.x actionpack
- CVE-2012-3464Cross-site scripting (XSS) vulnerability in activesupport/lib/active_support/core_ext/string/output_safety.rb in Ruby on Rails before 3.0.17activesupport
- CVE-2012-3465Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/sanitize_helper.rb in the strip_tags helper in Ruby on Rails actionpack
- CVE-2012-3424The decode_credentials method in actionpack/lib/action_controller/metal/http_authentication.rb in Ruby on Rails 3.x before 3.0.16, 3.1.x befactionpack
- CVE-2012-2660actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not properly actionpack
- CVE-2012-2661The Active Record component in Ruby on Rails 3.0.x before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not properly implement theactiverecord
- CVE-2012-2694actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.0.14, 3.1.x before 3.1.6, and 3.2.x before 3.2.6 does not properly actionpack
- CVE-2012-2695The Active Record component in Ruby on Rails before 3.0.14, 3.1.x before 3.1.6, and 3.2.x before 3.2.6 does not properly implement the passiactiverecord
- CVE-2012-1098Cross-site scripting (XSS) vulnerability in Ruby on Rails 3.0.x before 3.0.12, 3.1.x before 3.1.4, and 3.2.x before 3.2.2 allows remote attaactivesupport
- CVE-2012-1099Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/form_options_helper.rb in the select helper in Ruby on Rails actionpack
- CVE-2011-4319Cross-site scripting (XSS) vulnerability in the i18n translations helper method in Ruby on Rails 3.0.x before 3.0.11 and 3.1.x before 3.1.2,actionpack
- CVE-2011-2929The template selection functionality in actionpack/lib/action_view/template/resolver.rb in Ruby on Rails 3.0.x before 3.0.10 and 3.1.x beforactionpack
- CVE-2011-2930Multiple SQL injection vulnerabilities in the quote_table_name method in the ActiveRecord adapters in activerecord/lib/active_record/connectactiverecord
- CVE-2011-2931Cross-site scripting (XSS) vulnerability in the strip_tags helper in actionpack/lib/action_controller/vendor/html-scanner/html/node.rb in Ruactionpack
- CVE-2011-2932Cross-site scripting (XSS) vulnerability in activesupport/lib/active_support/core_ext/string/output_safety.rb in Ruby on Rails 2.x before 2.activesupport
- CVE-2011-3186CRLF injection vulnerability in actionpack/lib/action_controller/response.rb in Ruby on Rails 2.3.x before 2.3.13 allows remote attackers toactionpack
- CVE-2011-3187The to_s method in actionpack/lib/action_dispatch/middleware/remote_ip.rb in Ruby on Rails 3.0.5 does not validate the X-Forwarded-For headeactionpack
- CVE-2011-2197The cross-site scripting (XSS) prevention feature in Ruby on Rails 2.x before 2.3.12, 3.0.x before 3.0.8, and 3.1.x before 3.1.0.rc2 does noactionpack · activesupport
- CVE-2011-0449actionpack/lib/action_view/template/resolver.rb in Ruby on Rails 3.0.x before 3.0.4, when a case-insensitive filesystem is used, does not practionpack
- CVE-2011-0448Ruby on Rails 3.0.x before 3.0.4 does not ensure that arguments to the limit function specify integer values, which makes it easier for remoactiverecord
- CVE-2011-0446Multiple cross-site scripting (XSS) vulnerabilities in the mail_to helper in Ruby on Rails before 2.3.11, and 3.x before 3.0.4, when javascractionpack · actionview
- CVE-2011-0447Ruby on Rails 2.1.x, 2.2.x, and 2.3.x before 2.3.11, and 3.x before 3.0.4, does not properly validate HTTP requests that contain an X-Requesactionpack
- CVE-2010-3933Ruby on Rails 2.3.9 and 3.0.0 does not properly handle nested attributes, which allows remote attackers to modify arbitrary records by changactiverecord
- CVE-2008-7248Ruby on Rails 2.1 before 2.1.3 and 2.2.x before 2.2.2 does not verify tokens for requests with certain content types, which allows remote atactionpack
- CVE-2009-4214Cross-site scripting (XSS) vulnerability in the strip_tags function in Ruby on Rails before 2.2.s, and 2.3.x before 2.3.5, allows remote attrails
- CVE-2009-3009Cross-site scripting (XSS) vulnerability in Ruby on Rails 2.x before 2.2.3, and 2.3.x before 2.3.4, allows remote attackers to inject arbitractionpack · activesupport
- CVE-2009-3086A certain algorithm in Ruby on Rails 2.1.0 through 2.2.2, and 2.3.x before 2.3.4, leaks information about the complexity of message-digest sactionpack · activesupport
- CVE-2009-2422The example code for the digest authentication functionality (http_authentication.rb) in Ruby on Rails before 2.3.3 defines an authenticate_rails
- CVE-2008-5189CRLF injection vulnerability in Ruby on Rails before 2.0.5 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP responsrails
- CVE-2008-4094Multiple SQL injection vulnerabilities in Ruby on Rails before 2.1.1 allow remote attackers to execute arbitrary SQL commands via the (1) :lactiverecord
- CVE-2007-6077The session fixation protection mechanism in cgi_process.rb in Rails 1.2.4, as used in Ruby on Rails, removes the :cookie_only attribute frorails
- CVE-2007-5379Rails before 1.2.4, as used for Ruby on Rails, allows remote attackers and ActiveResource servers to determine the existence of arbitrary firails
- CVE-2007-5380Session fixation vulnerability in Rails before 1.2.4, as used for Ruby on Rails, allows remote attackers to hijack web sessions via unspecifrails
- CVE-2007-3227Cross-site scripting (XSS) vulnerability in the to_json (ActiveRecord::Base#to_json) function in Ruby on Rails before edge 9606 allows remotrails
- CVE-2006-4111Ruby on Rails before 1.1.5 allows remote attackers to execute Ruby code with "severe" or "serious" impact via a File Upload request with an rails
- CVE-2006-4112Unspecified vulnerability in the "dependency resolution mechanism" in Ruby on Rails 1.1.0 through 1.1.5 allows remote attackers to execute arails