# cve.now: Ruby on Rails

The newest entries affecting Ruby on Rails (up to 200). Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-81097](https://cve.now/CVE-2026-81097.md): rails-mcp-server 1.4.0 through 1.6.0 OS Command Execution via execute\_ruby PTY Escape (CVSS 8.6, maquina-app rails-mcp-server)
- [CVE-2026-73648](https://cve.now/CVE-2026-73648.md): rails-html-sanitizer: Possible XSS vulnerability with certain configurations (CVSS 5.1, rails-html-sanitizer)
- [CVE-2026-66066](https://cve.now/CVE-2026-66066.md): Action Pack: Possible arbitrary file read and remote code execution in Active Storage variant processing (CVSS 9.5, rails · activestorage)
- [CVE-2026-33176](https://cve.now/CVE-2026-33176.md): Rails Active Support has a possible DoS vulnerability in its number helpers (CVSS 6.6, rails activesupport · activesupport)
- [CVE-2026-33170](https://cve.now/CVE-2026-33170.md): Rails Active Support has a possible XSS vulnerability in SafeBuffer#% (CVSS 5.3, rails activesupport · activesupport)
- [CVE-2026-33169](https://cve.now/CVE-2026-33169.md): Rails Active Support has a possible ReDoS vulnerability in number\_to\_delimited (CVSS 6.9, rails activesupport · activesupport)
- [CVE-2026-33167](https://cve.now/CVE-2026-33167.md): Rails has a possible XSS vulnerability in its Action Pack debug exceptions (CVSS 1.3, rails actionpack · actionpack)
- [CVE-2025-55193](https://cve.now/CVE-2025-55193.md): Active Record logging vulnerable to ANSI escape injection (CVSS 2.7, rails · activerecord)
- [CVE-2023-23913](https://cve.now/CVE-2023-23913.md): There is a potential DOM based cross-site scripting issue in rails-ujs which leverages the Clipboard API to target HTML elements that are as (CVSS 6.3, rails-ujs · actionview)
- [CVE-2023-28362](https://cve.now/CVE-2023-28362.md): The redirect\_to method in Rails allows provided values to contain characters which are not legal in an HTTP header value. (CVSS 4.0, Rails Action Pack · actionpack)
- [CVE-2023-38037](https://cve.now/CVE-2023-38037.md): ActiveSupport::EncryptedFile writes contents that will be encrypted to a temporary file. (CVSS 5.5, Rails ActiveSupport · activesupport)
- [CVE-2023-28120](https://cve.now/CVE-2023-28120.md): There is a vulnerability in ActiveSupport if the new bytesplice method is called on a SafeBuffer with untrusted user input. (CVSS 5.3, Rails ActiveSupport · activesupport)
- [CVE-2024-54133](https://cve.now/CVE-2024-54133.md): Possible Content Security Policy bypass in Action Dispatch (CVSS 2.3, rails · actionpack)
- [CVE-2024-53985](https://cve.now/CVE-2024-53985.md): Possible XSS vulnerability with certain configurations of rails-html-sanitizer 1.6.0 (CVSS 2.3, rails-html-sanitizer)
- [CVE-2024-53987](https://cve.now/CVE-2024-53987.md): Possible XSS vulnerability with certain configurations of rails-html-sanitizer 1.6.0 (CVSS 2.3, rails-html-sanitizer)
- [CVE-2024-53986](https://cve.now/CVE-2024-53986.md): Possible XSS vulnerability with certain configurations of rails-html-sanitizer 1.6.0 (CVSS 2.3, rails-html-sanitizer)
- [CVE-2024-53988](https://cve.now/CVE-2024-53988.md): Possible XSS vulnerability with certain configurations of rails-html-sanitizer 1.6.0 (CVSS 2.3, rails-html-sanitizer)
- [CVE-2024-53989](https://cve.now/CVE-2024-53989.md): Possible XSS vulnerability with certain configurations of rails-html-sanitizer 1.6.0 (CVSS 2.3, rails-html-sanitizer)
- [CVE-2024-47889](https://cve.now/CVE-2024-47889.md): Action Mailer has possible ReDoS vulnerability in block\_format (CVSS 6.6, rails · actionmailer)
- [CVE-2024-47888](https://cve.now/CVE-2024-47888.md): Action Text has possible ReDoS vulnerability in plain\_text\_for\_blockquote\_node (CVSS 6.6, rails · actiontext)
- [CVE-2024-47887](https://cve.now/CVE-2024-47887.md): Action Controller has possible ReDoS vulnerability in HTTP Token authentication (CVSS 6.6, rails · actionpack)
- [CVE-2024-41128](https://cve.now/CVE-2024-41128.md): Action Dispatch has possible ReDoS vulnerability in query parameter filtering (CVSS 6.6, rails · actionpack)
- [CVE-2024-39308](https://cve.now/CVE-2024-39308.md): RailsAdmin Cross-site Scripting vulnerability in the list view (CVSS 6.8, railsadminteam rails\_admin · rails\_admin)
- [CVE-2024-32464](https://cve.now/CVE-2024-32464.md): ActionText ContentAttachment can Contain Unsanitized HTML (CVSS 6.1, rails · actiontext)
- [CVE-2024-28103](https://cve.now/CVE-2024-28103.md): Action Pack is missing security headers on non-HTML responses (CVSS 5.4, rails · actionpack)
- [CVE-2024-26144](https://cve.now/CVE-2024-26144.md): Possible Sensitive Session Information Leak in Active Storage (CVSS 5.3, rails · activestorage)
- [CVE-2024-26143](https://cve.now/CVE-2024-26143.md): Rails Possible XSS Vulnerability in Action Controller (CVSS 6.1, rails · actionpack)
- [CVE-2024-26142](https://cve.now/CVE-2024-26142.md): Rails possible ReDoS vulnerability in Accept header parsing in Action Dispatch (CVSS 7.5, rails · actionpack)
- [CVE-2022-44566](https://cve.now/CVE-2022-44566.md): A denial of service vulnerability present in ActiveRecord's PostgreSQL adapter \<7.0.4.1 and \<6.1.7.1. (CVSS 7.5, https://github.com/rails/rails · activerecord)
- [CVE-2023-22792](https://cve.now/CVE-2023-22792.md): A regular expression based DoS vulnerability in Action Dispatch \<6.0.6.1,\< 6.1.7.1, and \<7.0.4.1. (CVSS 7.5, https://github.com/rails/rails · actionpack)
- [CVE-2023-22794](https://cve.now/CVE-2023-22794.md): A vulnerability in ActiveRecord \<6.0.6.1, v6.1.7.1 and v7.0.4.1 related to the sanitization of comments. (no CVSS, https://github.com/rails/rails · activerecord)
- [CVE-2023-22795](https://cve.now/CVE-2023-22795.md): A regular expression based DoS vulnerability in Action Dispatch \<6.1.7.1 and \<7.0.4.1 related to the If-None-Match header. (no CVSS, https://github.com/rails/rails · actionpack)
- [CVE-2023-22796](https://cve.now/CVE-2023-22796.md): A regular expression based DoS vulnerability in Active Support \<6.1.7.1 and \<7.0.4.1. (no CVSS, https://github.com/rails/rails · activesupport)
- [CVE-2023-22797](https://cve.now/CVE-2023-22797.md): An open redirect vulnerability is fixed in Rails 7.0.4.1 with the new protection against open redirects from calling redirect\_to with untrus (CVSS 6.1, https://github.com/rails/rails · actionpack)
- [CVE-2014-125033](https://cve.now/CVE-2014-125033.md): rails-cv-app uploaded\_files\_controller.rb path traversal (CVSS 3.5, rails-cv-app)
- [CVE-2022-23520](https://cve.now/CVE-2022-23520.md): rails-html-sanitizer contains an incomplete fix for an XSS vulnerability (CVSS 6.1, rails-html-sanitizer)
- [CVE-2022-23519](https://cve.now/CVE-2022-23519.md): Possible XSS vulnerability with certain configurations of rails-html-sanitizer (CVSS 7.2, rails-html-sanitizer)
- [CVE-2022-23518](https://cve.now/CVE-2022-23518.md): Improper neutralization of data URIs allows XSS in rails-html-sanitizer (CVSS 6.1, rails-html-sanitizer)
- [CVE-2022-23517](https://cve.now/CVE-2022-23517.md): Inefficient Regular Expression Complexity in rails-html-sanitizer (CVSS 7.5, rails-html-sanitizer)
- [CVE-2022-32224](https://cve.now/CVE-2022-32224.md): A possible escalation to RCE vulnerability exists when using YAML serialized columns in Active Record \< 7.0.3.1, \<6.1.6.1, \<6.0.5.1 and \<5.2 (CVSS 9.8, https://github.com/rails/rails · activerecord)
- [CVE-2022-3704](https://cve.now/CVE-2022-3704.md): Ruby on Rails \_table.html.erb cross site scripting (CVSS 3.5, Ruby on Rails)
- [CVE-2022-22577](https://cve.now/CVE-2022-22577.md): An XSS Vulnerability in Action Pack \>= 5.2.0 and \< 5.2.0 that could allow an attacker to bypass CSP for non HTML like responses. (no CVSS, https://github.com/rails/rails · actionpack)
- [CVE-2022-23633](https://cve.now/CVE-2022-23633.md): Exposure of sensitive information in Action Pack (CVSS 7.4, rails · actionpack)
- [CVE-2021-44528](https://cve.now/CVE-2021-44528.md): A open redirect vulnerability exists in Action Pack \>= 6.0.0 that could allow an attacker to craft a "X-Forwarded-Host" headers in combinati (no CVSS, https://github.com/rails/rails · actionpack)
- [CVE-2021-41263](https://cve.now/CVE-2021-41263.md): Secure/signed cookies share secrets between sites in rails\_multisite (CVSS 8.3, discourse rails\_multisite · rails\_multisite)
- [CVE-2011-1497](https://cve.now/CVE-2011-1497.md): A cross-site scripting vulnerability flaw was found in the auto\_link function in Rails before version 3.0.6. (no CVSS, rails · actionpack)
- [CVE-2021-22942](https://cve.now/CVE-2021-22942.md): A possible open redirect vulnerability in the Host Authorization middleware in Action Pack \>= 6.0.0 that could allow attackers to redirect u (no CVSS, https://github.com/rails/rails · actionpack)
- [CVE-2021-22902](https://cve.now/CVE-2021-22902.md): The actionpack ruby gem (a framework for handling and responding to web requests in Rails) before 6.0.3.7, 6.1.3.2 suffers from a possible d (no CVSS, https://github.com/rails/rails · actionpack)
- [CVE-2021-22903](https://cve.now/CVE-2021-22903.md): The actionpack ruby gem before 6.1.3.2 suffers from a possible open redirect vulnerability. (no CVSS, https://github.com/rails/rails · actionpack)
- [CVE-2021-22904](https://cve.now/CVE-2021-22904.md): The actionpack ruby gem before 6.1.3.2, 6.0.3.7, 5.2.4.6, 5.2.6 suffers from a possible denial of service vulnerability in the Token Authent (no CVSS, https://github.com/rails/rails · actionpack)
- [CVE-2021-22885](https://cve.now/CVE-2021-22885.md): A possible information disclosure / unintended method execution vulnerability in Action Pack \>= 2.0.0 when using the \`redirect\_to\` or \`polym (no CVSS, https://github.com/rails/rails · actionpack)
- [CVE-2021-22881](https://cve.now/CVE-2021-22881.md): The Host Authorization middleware in Action Pack before 6.1.2.1, 6.0.3.5 suffers from an open redirect vulnerability. (no CVSS, https://github.com/rails/rails · actionpack)
- [CVE-2021-22880](https://cve.now/CVE-2021-22880.md): The PostgreSQL adapter in Active Record before 6.1.2.1, 6.0.3.5, 5.2.4.5 suffers from a regular expression denial of service (REDoS) vulnera (no CVSS, https://github.com/rails/rails · activerecord)
- [CVE-2020-8264](https://cve.now/CVE-2020-8264.md): In actionpack gem \>= 6.0.0, a possible XSS vulnerability exists when an application is running in development mode allowing an attacker to s (no CVSS, https://github.com/rails/rails · actionpack)
- [CVE-2020-8166](https://cve.now/CVE-2020-8166.md): A CSRF forgery vulnerability exists in rails \< 5.2.5, rails \< 6.0.4 that makes it possible for an attacker to, given a global CSRF token suc (CVSS 4.3, https://github.com/rails/rails · actionpack)
- [CVE-2020-8185](https://cve.now/CVE-2020-8185.md): A denial of service vulnerability exists in Rails \<6.0.3.2 that allowed an untrusted user to run any pending migrations on a Rails app runni (no CVSS, https://github.com/rails/rails · actionpack)
- [CVE-2020-8165](https://cve.now/CVE-2020-8165.md): A deserialization of untrusted data vulnernerability exists in rails \< 5.2.4.3, rails \< 6.0.3.1 that can allow an attacker to unmarshal user (no CVSS, https://github.com/rails/rails · activesupport)
- [CVE-2020-8164](https://cve.now/CVE-2020-8164.md): A deserialization of untrusted data vulnerability exists in rails \< 5.2.4.3, rails \< 6.0.3.1 which can allow an attacker to supply informati (no CVSS, https://github.com/rails/rails · actionpack)
- [CVE-2010-3299](https://cve.now/CVE-2010-3299.md): The encrypt/decrypt functions in Ruby on Rails 2.3 are vulnerable to padding oracle attacks. (no CVSS, rails)
- [CVE-2016-10522](https://cve.now/CVE-2016-10522.md): rails\_admin ruby gem \<v1.1.1 is vulnerable to cross-site request forgery (CSRF) attacks. (no CVSS, https://github.com/sferik rails\_admin ruby gem · rails\_admin)
- [CVE-2018-3741](https://cve.now/CVE-2018-3741.md): There is a possible XSS vulnerability in all rails-html-sanitizer gem versions below 1.0.4 for Ruby. (no CVSS, rails-html-sanitizer)
- [CVE-2016-6317](https://cve.now/CVE-2016-6317.md): Action Record in Ruby on Rails 4.2.x before 4.2.7.1 does not properly consider differences in parameter handling between the Active Record c (no CVSS, activerecord)
- [CVE-2016-2097](https://cve.now/CVE-2016-2097.md): Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.2 and 4.x before 4.1.14.2 allows remote attackers to read ar (no CVSS, actionview · actionpack)
- [CVE-2016-2098](https://cve.now/CVE-2016-2098.md): Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary Rub (no CVSS, actionpack)
- [CVE-2015-7576](https://cve.now/CVE-2015-7576.md): The http\_basic\_authenticate\_with method in actionpack/lib/action\_controller/metal/http\_authentication.rb in the Basic Authentication impleme (no CVSS, actionpack)
- [CVE-2015-7577](https://cve.now/CVE-2015-7577.md): activerecord/lib/active\_record/nested\_attributes.rb in Active Record in Ruby on Rails 3.1.x and 3.2.x before 3.2.22.1, 4.0.x and 4.1.x befor (no CVSS, activerecord)
- [CVE-2015-7581](https://cve.now/CVE-2015-7581.md): actionpack/lib/action\_dispatch/routing/route\_set.rb in Action Pack in Ruby on Rails 4.x before 4.2.5.1 and 5.x before 5.0.0.beta1.1 allows r (no CVSS, actionpack)
- [CVE-2016-0751](https://cve.now/CVE-2016-0751.md): actionpack/lib/action\_dispatch/http/mime\_type.rb in Action Pack in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x bef (no CVSS, actionpack)
- [CVE-2016-0752](https://cve.now/CVE-2016-0752.md): Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, an (CVSS 7.5, KEV, actionview · actionpack)
- [CVE-2015-3226](https://cve.now/CVE-2015-3226.md): Cross-site scripting (XSS) vulnerability in json/encoding.rb in Active Support in Ruby on Rails 3.x and 4.1.x before 4.1.11 and 4.2.x before (no CVSS, activesupport)
- [CVE-2015-3227](https://cve.now/CVE-2015-3227.md): The (1) jdom.rb and (2) rexml.rb components in Active Support in Ruby on Rails before 4.1.11 and 4.2.x before 4.2.2, when JDOM or REXML is e (no CVSS, activesupport)
- [CVE-2014-7829](https://cve.now/CVE-2014-7829.md): Directory traversal vulnerability in actionpack/lib/action\_dispatch/middleware/static.rb in Action Pack in Ruby on Rails 3.x before 3.2.21, (no CVSS, actionpack)
- [CVE-2014-7818](https://cve.now/CVE-2014-7818.md): Directory traversal vulnerability in actionpack/lib/action\_dispatch/middleware/static.rb in Action Pack in Ruby on Rails 3.x before 3.2.20, (no CVSS, actionpack)
- [CVE-2014-3514](https://cve.now/CVE-2014-3514.md): activerecord/lib/active\_record/relation/query\_methods.rb in Active Record in Ruby on Rails 4.0.x before 4.0.9 and 4.1.x before 4.1.5 allows (no CVSS, activerecord)
- [CVE-2014-3482](https://cve.now/CVE-2014-3482.md): SQL injection vulnerability in activerecord/lib/active\_record/connection\_adapters/postgresql\_adapter.rb in the PostgreSQL adapter for Active (no CVSS, activerecord)
- [CVE-2014-3483](https://cve.now/CVE-2014-3483.md): SQL injection vulnerability in activerecord/lib/active\_record/connection\_adapters/postgresql/quoting.rb in the PostgreSQL adapter for Active (no CVSS, activerecord)
- [CVE-2014-0130](https://cve.now/CVE-2014-0130.md): Directory traversal vulnerability in actionpack/lib/abstract\_controller/base.rb in the implicit-render implementation in Ruby on Rails befor (CVSS 7.5, KEV, actionpack)
- [CVE-2014-0080](https://cve.now/CVE-2014-0080.md): SQL injection vulnerability in activerecord/lib/active\_record/connection\_adapters/postgresql/cast.rb in Active Record in Ruby on Rails 4.0.x (no CVSS, activerecord)
- [CVE-2014-0081](https://cve.now/CVE-2014-0081.md): Multiple cross-site scripting (XSS) vulnerabilities in actionview/lib/action\_view/helpers/number\_helper.rb in Ruby on Rails before 3.2.17, 4 (no CVSS, rails · actionpack)
- [CVE-2014-0082](https://cve.now/CVE-2014-0082.md): actionpack/lib/action\_view/template/text.rb in Action View in Ruby on Rails 3.x before 3.2.17 converts MIME type strings to symbols during u (no CVSS, actionpack)
- [CVE-2013-4491](https://cve.now/CVE-2013-4491.md): Cross-site scripting (XSS) vulnerability in actionpack/lib/action\_view/helpers/translation\_helper.rb in the internationalization component i (no CVSS, actionpack)
- [CVE-2013-6414](https://cve.now/CVE-2013-6414.md): actionpack/lib/action\_view/lookup\_context.rb in Action View in Ruby on Rails 3.x before 3.2.16 and 4.x before 4.0.2 allows remote attackers (no CVSS, actionpack)
- [CVE-2013-6415](https://cve.now/CVE-2013-6415.md): Cross-site scripting (XSS) vulnerability in the number\_to\_currency helper in actionpack/lib/action\_view/helpers/number\_helper.rb in Ruby on (no CVSS, actionpack)
- [CVE-2013-6416](https://cve.now/CVE-2013-6416.md): Cross-site scripting (XSS) vulnerability in the simple\_format helper in actionpack/lib/action\_view/helpers/text\_helper.rb in Ruby on Rails 4 (no CVSS, actionpack)
- [CVE-2013-6417](https://cve.now/CVE-2013-6417.md): actionpack/lib/action\_dispatch/http/request.rb in Ruby on Rails before 3.2.16 and 4.x before 4.0.2 does not properly consider differences in (no CVSS, actionpack)
- [CVE-2013-3221](https://cve.now/CVE-2013-3221.md): The Active Record component in Ruby on Rails 2.3.x, 3.0.x, 3.1.x, and 3.2.x does not ensure that the declared data type of a database column (no CVSS, activerecord)
- [CVE-2013-1854](https://cve.now/CVE-2013-1854.md): The Active Record component in Ruby on Rails 2.3.x before 2.3.18, 3.1.x before 3.1.12, and 3.2.x before 3.2.13 processes certain queries by (no CVSS, activerecord)
- [CVE-2013-1855](https://cve.now/CVE-2013-1855.md): The sanitize\_css method in lib/action\_controller/vendor/html-scanner/html/sanitizer.rb in the Action Pack component in Ruby on Rails before (no CVSS, actionpack)
- [CVE-2013-1856](https://cve.now/CVE-2013-1856.md): The ActiveSupport::XmlMini\_JDOM backend in lib/active\_support/xml\_mini/jdom.rb in the Active Support component in Ruby on Rails 3.0.x and 3. (no CVSS, activesupport)
- [CVE-2013-1857](https://cve.now/CVE-2013-1857.md): The sanitize helper in lib/action\_controller/vendor/html-scanner/html/sanitizer.rb in the Action Pack component in Ruby on Rails before 2.3. (no CVSS, actionpack)
- [CVE-2013-0276](https://cve.now/CVE-2013-0276.md): ActiveRecord in Ruby on Rails before 2.3.17, 3.1.x before 3.1.11, and 3.2.x before 3.2.12 allows remote attackers to bypass the attr\_protect (no CVSS, activerecord)
- [CVE-2013-0277](https://cve.now/CVE-2013-0277.md): ActiveRecord in Ruby on Rails before 2.3.17 and 3.x before 3.1.0 allows remote attackers to cause a denial of service or execute arbitrary c (no CVSS, activerecord)
- [CVE-2013-0333](https://cve.now/CVE-2013-0333.md): lib/active\_support/json/backends/yaml.rb in Ruby on Rails 2.3.x before 2.3.16 and 3.0.x before 3.0.20 does not properly convert JSON data to (no CVSS, activesupport)
- [CVE-2013-0155](https://cve.now/CVE-2013-0155.md): Ruby on Rails 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly consider differences in parameter handling (no CVSS, activerecord)
- [CVE-2013-0156](https://cve.now/CVE-2013-0156.md): active\_support/core\_ext/hash/conversions.rb in Ruby on Rails before 2.3.15, 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.1 (no CVSS, actionpack)
- [CVE-2012-6496](https://cve.now/CVE-2012-6496.md): SQL injection vulnerability in the Active Record component in Ruby on Rails before 3.0.18, 3.1.x before 3.1.9, and 3.2.x before 3.2.10 allow (no CVSS, activerecord)
- [CVE-2012-3463](https://cve.now/CVE-2012-3463.md): Cross-site scripting (XSS) vulnerability in actionpack/lib/action\_view/helpers/form\_tag\_helper.rb in Ruby on Rails 3.x before 3.0.17, 3.1.x (no CVSS, actionpack)
- [CVE-2012-3464](https://cve.now/CVE-2012-3464.md): Cross-site scripting (XSS) vulnerability in activesupport/lib/active\_support/core\_ext/string/output\_safety.rb in Ruby on Rails before 3.0.17 (no CVSS, activesupport)
- [CVE-2012-3465](https://cve.now/CVE-2012-3465.md): Cross-site scripting (XSS) vulnerability in actionpack/lib/action\_view/helpers/sanitize\_helper.rb in the strip\_tags helper in Ruby on Rails (no CVSS, actionpack)
- [CVE-2012-3424](https://cve.now/CVE-2012-3424.md): The decode\_credentials method in actionpack/lib/action\_controller/metal/http\_authentication.rb in Ruby on Rails 3.x before 3.0.16, 3.1.x bef (no CVSS, actionpack)
- [CVE-2012-2660](https://cve.now/CVE-2012-2660.md): actionpack/lib/action\_dispatch/http/request.rb in Ruby on Rails before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not properly (no CVSS, actionpack)
- [CVE-2012-2661](https://cve.now/CVE-2012-2661.md): The Active Record component in Ruby on Rails 3.0.x before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not properly implement the (no CVSS, activerecord)
- [CVE-2012-2694](https://cve.now/CVE-2012-2694.md): actionpack/lib/action\_dispatch/http/request.rb in Ruby on Rails before 3.0.14, 3.1.x before 3.1.6, and 3.2.x before 3.2.6 does not properly (no CVSS, actionpack)
- [CVE-2012-2695](https://cve.now/CVE-2012-2695.md): The Active Record component in Ruby on Rails before 3.0.14, 3.1.x before 3.1.6, and 3.2.x before 3.2.6 does not properly implement the passi (no CVSS, activerecord)
- [CVE-2012-1098](https://cve.now/CVE-2012-1098.md): Cross-site scripting (XSS) vulnerability in Ruby on Rails 3.0.x before 3.0.12, 3.1.x before 3.1.4, and 3.2.x before 3.2.2 allows remote atta (no CVSS, activesupport)
- [CVE-2012-1099](https://cve.now/CVE-2012-1099.md): Cross-site scripting (XSS) vulnerability in actionpack/lib/action\_view/helpers/form\_options\_helper.rb in the select helper in Ruby on Rails (no CVSS, actionpack)
- [CVE-2011-4319](https://cve.now/CVE-2011-4319.md): Cross-site scripting (XSS) vulnerability in the i18n translations helper method in Ruby on Rails 3.0.x before 3.0.11 and 3.1.x before 3.1.2, (no CVSS, actionpack)
- [CVE-2011-2929](https://cve.now/CVE-2011-2929.md): The template selection functionality in actionpack/lib/action\_view/template/resolver.rb in Ruby on Rails 3.0.x before 3.0.10 and 3.1.x befor (no CVSS, actionpack)
- [CVE-2011-2930](https://cve.now/CVE-2011-2930.md): Multiple SQL injection vulnerabilities in the quote\_table\_name method in the ActiveRecord adapters in activerecord/lib/active\_record/connect (no CVSS, activerecord)
- [CVE-2011-2931](https://cve.now/CVE-2011-2931.md): Cross-site scripting (XSS) vulnerability in the strip\_tags helper in actionpack/lib/action\_controller/vendor/html-scanner/html/node.rb in Ru (no CVSS, actionpack)
- [CVE-2011-2932](https://cve.now/CVE-2011-2932.md): Cross-site scripting (XSS) vulnerability in activesupport/lib/active\_support/core\_ext/string/output\_safety.rb in Ruby on Rails 2.x before 2. (no CVSS, activesupport)
- [CVE-2011-3186](https://cve.now/CVE-2011-3186.md): CRLF injection vulnerability in actionpack/lib/action\_controller/response.rb in Ruby on Rails 2.3.x before 2.3.13 allows remote attackers to (no CVSS, actionpack)
- [CVE-2011-3187](https://cve.now/CVE-2011-3187.md): The to\_s method in actionpack/lib/action\_dispatch/middleware/remote\_ip.rb in Ruby on Rails 3.0.5 does not validate the X-Forwarded-For heade (no CVSS, actionpack)
- [CVE-2011-2197](https://cve.now/CVE-2011-2197.md): The cross-site scripting (XSS) prevention feature in Ruby on Rails 2.x before 2.3.12, 3.0.x before 3.0.8, and 3.1.x before 3.1.0.rc2 does no (no CVSS, actionpack · activesupport)
- [CVE-2011-0449](https://cve.now/CVE-2011-0449.md): actionpack/lib/action\_view/template/resolver.rb in Ruby on Rails 3.0.x before 3.0.4, when a case-insensitive filesystem is used, does not pr (no CVSS, actionpack)
- [CVE-2011-0448](https://cve.now/CVE-2011-0448.md): Ruby on Rails 3.0.x before 3.0.4 does not ensure that arguments to the limit function specify integer values, which makes it easier for remo (no CVSS, activerecord)
- [CVE-2011-0446](https://cve.now/CVE-2011-0446.md): Multiple cross-site scripting (XSS) vulnerabilities in the mail\_to helper in Ruby on Rails before 2.3.11, and 3.x before 3.0.4, when javascr (no CVSS, actionpack · actionview)
- [CVE-2011-0447](https://cve.now/CVE-2011-0447.md): Ruby on Rails 2.1.x, 2.2.x, and 2.3.x before 2.3.11, and 3.x before 3.0.4, does not properly validate HTTP requests that contain an X-Reques (no CVSS, actionpack)
- [CVE-2010-3933](https://cve.now/CVE-2010-3933.md): Ruby on Rails 2.3.9 and 3.0.0 does not properly handle nested attributes, which allows remote attackers to modify arbitrary records by chang (no CVSS, activerecord)
- [CVE-2008-7248](https://cve.now/CVE-2008-7248.md): Ruby on Rails 2.1 before 2.1.3 and 2.2.x before 2.2.2 does not verify tokens for requests with certain content types, which allows remote at (no CVSS, actionpack)
- [CVE-2009-4214](https://cve.now/CVE-2009-4214.md): Cross-site scripting (XSS) vulnerability in the strip\_tags function in Ruby on Rails before 2.2.s, and 2.3.x before 2.3.5, allows remote att (no CVSS, rails)
- [CVE-2009-3009](https://cve.now/CVE-2009-3009.md): Cross-site scripting (XSS) vulnerability in Ruby on Rails 2.x before 2.2.3, and 2.3.x before 2.3.4, allows remote attackers to inject arbitr (no CVSS, actionpack · activesupport)
- [CVE-2009-3086](https://cve.now/CVE-2009-3086.md): A certain algorithm in Ruby on Rails 2.1.0 through 2.2.2, and 2.3.x before 2.3.4, leaks information about the complexity of message-digest s (no CVSS, actionpack · activesupport)
- [CVE-2009-2422](https://cve.now/CVE-2009-2422.md): The example code for the digest authentication functionality (http\_authentication.rb) in Ruby on Rails before 2.3.3 defines an authenticate\_ (no CVSS, rails)
- [CVE-2008-5189](https://cve.now/CVE-2008-5189.md): CRLF injection vulnerability in Ruby on Rails before 2.0.5 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP respons (no CVSS, rails)
- [CVE-2008-4094](https://cve.now/CVE-2008-4094.md): Multiple SQL injection vulnerabilities in Ruby on Rails before 2.1.1 allow remote attackers to execute arbitrary SQL commands via the (1) :l (no CVSS, activerecord)
- [CVE-2007-6077](https://cve.now/CVE-2007-6077.md): The session fixation protection mechanism in cgi\_process.rb in Rails 1.2.4, as used in Ruby on Rails, removes the :cookie\_only attribute fro (no CVSS, rails)
- [CVE-2007-5379](https://cve.now/CVE-2007-5379.md): Rails before 1.2.4, as used for Ruby on Rails, allows remote attackers and ActiveResource servers to determine the existence of arbitrary fi (no CVSS, rails)
- [CVE-2007-5380](https://cve.now/CVE-2007-5380.md): Session fixation vulnerability in Rails before 1.2.4, as used for Ruby on Rails, allows remote attackers to hijack web sessions via unspecif (no CVSS, rails)
- [CVE-2007-3227](https://cve.now/CVE-2007-3227.md): Cross-site scripting (XSS) vulnerability in the to\_json (ActiveRecord::Base#to\_json) function in Ruby on Rails before edge 9606 allows remot (no CVSS, rails)
- [CVE-2006-4111](https://cve.now/CVE-2006-4111.md): Ruby on Rails before 1.1.5 allows remote attackers to execute Ruby code with "severe" or "serious" impact via a File Upload request with an (no CVSS, rails)
- [CVE-2006-4112](https://cve.now/CVE-2006-4112.md): Unspecified vulnerability in the "dependency resolution mechanism" in Ruby on Rails 1.1.0 through 1.1.5 allows remote attackers to execute a (no CVSS, rails)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/tech/rails
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.