Search
Find a vulnerability
Search criteria
90 vulnerabilities by Rails
CVE-2026-33658 (GCVE-0-2026-33658)
Vulnerability from nvd – Published: 2026-03-26 21:03 – Updated: 2026-03-30 11:42
VLAI
EPSS
VEX
Title
Rails Active Storage has a possible DoS vulnerability in proxy mode via multi-range requests
Summary
Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1
Active Storage's proxy controller does not limit the number of byte ranges in an HTTP Range header. A request with thousands of small ranges causes disproportionate CPU usage compared to a normal request for the same file, possibly resulting in a DoS vulnerability. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/rails/rails/security/advisorie… | x_refsource_CONFIRM |
| https://github.com/rails/rails/releases/tag/v7.2.3.1 | x_refsource_MISC |
| https://github.com/rails/rails/releases/tag/v8.0.4.1 | x_refsource_MISC |
| https://github.com/rails/rails/releases/tag/v8.1.2.1 | x_refsource_MISC |
| https://github.com/rubysec/ruby-advisory-db/blob/… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| rails | activestorage |
Affected:
>= 8.1.0, < 8.1.2.1
Affected: >= 8.0.0, < 8.0.4.1 Affected: < 7.2.3.1 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-33658",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-30T11:42:16.532847Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-30T11:42:24.885Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "activestorage",
"vendor": "rails",
"versions": [
{
"status": "affected",
"version": "\u003e= 8.1.0, \u003c 8.1.2.1"
},
{
"status": "affected",
"version": "\u003e= 8.0.0, \u003c 8.0.4.1"
},
{
"status": "affected",
"version": "\u003c 7.2.3.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1\nActive Storage\u0027s proxy controller does not limit the number of byte ranges in an HTTP Range header. A request with thousands of small ranges causes disproportionate CPU usage compared to a normal request for the same file, possibly resulting in a DoS vulnerability. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.3,
"baseSeverity": "LOW",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770: Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-26T21:03:25.319Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/rails/rails/security/advisories/GHSA-p9fm-f462-ggrg",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/rails/rails/security/advisories/GHSA-p9fm-f462-ggrg"
},
{
"name": "https://github.com/rails/rails/releases/tag/v7.2.3.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/releases/tag/v7.2.3.1"
},
{
"name": "https://github.com/rails/rails/releases/tag/v8.0.4.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/releases/tag/v8.0.4.1"
},
{
"name": "https://github.com/rails/rails/releases/tag/v8.1.2.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/releases/tag/v8.1.2.1"
},
{
"name": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activestorage/CVE-2026-33658.yml",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activestorage/CVE-2026-33658.yml"
}
],
"source": {
"advisory": "GHSA-p9fm-f462-ggrg",
"discovery": "UNKNOWN"
},
"title": "Rails Active Storage has a possible DoS vulnerability in proxy mode via multi-range requests"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-33658",
"datePublished": "2026-03-26T21:03:25.319Z",
"dateReserved": "2026-03-23T15:23:42.219Z",
"dateUpdated": "2026-03-30T11:42:24.885Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-33202 (GCVE-0-2026-33202)
Vulnerability from nvd – Published: 2026-03-23 23:34 – Updated: 2026-03-24 15:44
VLAI
EPSS
VEX
Title
Rails Active Storage has possible glob injection in its DiskService
Summary
Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Storage's `DiskService#delete_prefixed` passes blob keys directly to `Dir.glob` without escaping glob metacharacters. If a blob key contains attacker-controlled input or custom-generated keys with glob metacharacters, it may be possible to delete unintended files from the storage directory. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/rails/rails/security/advisorie… | x_refsource_CONFIRM |
| https://github.com/rails/rails/commit/8c9676b8038… | x_refsource_MISC |
| https://github.com/rails/rails/commit/955284d26e4… | x_refsource_MISC |
| https://github.com/rails/rails/commit/fa190735463… | x_refsource_MISC |
| https://github.com/rails/rails/releases/tag/v7.2.3.1 | x_refsource_MISC |
| https://github.com/rails/rails/releases/tag/v8.0.4.1 | x_refsource_MISC |
| https://github.com/rails/rails/releases/tag/v8.1.2.1 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| rails | activestorage |
Affected:
>= 8.1.0.beta1, < 8.1.2.1
Affected: >= 8.0.0.beta1, < 8.0.4.1 Affected: < 7.2.3.1 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-33202",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-24T15:42:33.496549Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-24T15:44:19.018Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "activestorage",
"vendor": "rails",
"versions": [
{
"status": "affected",
"version": "\u003e= 8.1.0.beta1, \u003c 8.1.2.1"
},
{
"status": "affected",
"version": "\u003e= 8.0.0.beta1, \u003c 8.0.4.1"
},
{
"status": "affected",
"version": "\u003c 7.2.3.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Storage\u0027s `DiskService#delete_prefixed` passes blob keys directly to `Dir.glob` without escaping glob metacharacters. If a blob key contains attacker-controlled input or custom-generated keys with glob metacharacters, it may be possible to delete unintended files from the storage directory. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-23T23:34:52.715Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/rails/rails/security/advisories/GHSA-73f9-jhhh-hr5m",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/rails/rails/security/advisories/GHSA-73f9-jhhh-hr5m"
},
{
"name": "https://github.com/rails/rails/commit/8c9676b803820110548cdb7523800db43bc6874c",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/commit/8c9676b803820110548cdb7523800db43bc6874c"
},
{
"name": "https://github.com/rails/rails/commit/955284d26e469a9c026a4eee5b21f0414ab0bccf",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/commit/955284d26e469a9c026a4eee5b21f0414ab0bccf"
},
{
"name": "https://github.com/rails/rails/commit/fa19073546360856e9f4dab221fc2c5d73a45e82",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/commit/fa19073546360856e9f4dab221fc2c5d73a45e82"
},
{
"name": "https://github.com/rails/rails/releases/tag/v7.2.3.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/releases/tag/v7.2.3.1"
},
{
"name": "https://github.com/rails/rails/releases/tag/v8.0.4.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/releases/tag/v8.0.4.1"
},
{
"name": "https://github.com/rails/rails/releases/tag/v8.1.2.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/releases/tag/v8.1.2.1"
}
],
"source": {
"advisory": "GHSA-73f9-jhhh-hr5m",
"discovery": "UNKNOWN"
},
"title": "Rails Active Storage has possible glob injection in its DiskService"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-33202",
"datePublished": "2026-03-23T23:34:52.715Z",
"dateReserved": "2026-03-17T23:23:58.312Z",
"dateUpdated": "2026-03-24T15:44:19.018Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-33195 (GCVE-0-2026-33195)
Vulnerability from nvd – Published: 2026-03-23 23:31 – Updated: 2026-06-30 12:07
VLAI
EPSS
VEX
Title
Rails Active Storage has possible Path Traversal in DiskService
Summary
Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Storage's `DiskService#path_for` does not validate that the resolved filesystem path remains within the storage root directory. If a blob key containing path traversal sequences (e.g. `../`) is used, it could allow reading, writing, or deleting arbitrary files on the server. Blob keys are expected to be trusted strings, but some applications could be passing user input as keys and would be affected. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
10 references
| URL | Tags |
|---|---|
| https://github.com/rails/rails/security/advisorie… | x_refsource_CONFIRM |
| https://github.com/rails/rails/commit/4933c1e3b8c… | x_refsource_MISC |
| https://github.com/rails/rails/commit/9b06fbc0f50… | x_refsource_MISC |
| https://github.com/rails/rails/commit/a290c8a1ec1… | x_refsource_MISC |
| https://github.com/rails/rails/releases/tag/v7.2.3.1 | x_refsource_MISC |
| https://github.com/rails/rails/releases/tag/v8.0.4.1 | x_refsource_MISC |
| https://github.com/rails/rails/releases/tag/v8.1.2.1 | x_refsource_MISC |
| https://access.redhat.com/security/cve/CVE-2026-33195 | vdb-entryx_refsource_REDHAT |
| https://bugzilla.redhat.com/show_bug.cgi?id=2450546 | issue-trackingx_refsource_REDHAT |
| https://security.access.redhat.com/data/csaf/v2/v… | x_sadp-csaf-vex |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| rails | activestorage |
Affected:
>= 8.1.0.beta1, < 8.1.2.1
Affected: >= 8.0.0.beta1, < 8.0.4.1 Affected: < 7.2.3.1 |
|
| Red Hat | Red Hat 3scale API Management Platform 2 |
cpe:/a:redhat:red_hat_3scale_amp:2 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-33195",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-24T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T03:56:06.239Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"affected": [
{
"cpes": [
"cpe:/a:redhat:red_hat_3scale_amp:2"
],
"defaultStatus": "affected",
"product": "Red Hat 3scale API Management Platform 2",
"vendor": "Red Hat"
}
],
"datePublic": "2026-03-23T23:31:41.785Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in Active Storage, a component of Rails applications that manages file attachments. This vulnerability allows an attacker to manipulate file paths by using specially crafted input in blob keys. This manipulation can lead to unauthorized reading, writing, or deletion of arbitrary files on the server, potentially compromising the integrity and confidentiality of data."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-30T12:07:37.905Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-33195"
},
{
"name": "RHBZ#2450546",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450546"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33195.json"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-03-24T00:01:50.330Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-03-23T23:31:41.785Z",
"value": "Made public."
}
],
"title": "Rails: Active Storage: Active Storage (Rails): Arbitrary file access via path traversal in blob keys",
"workarounds": [
{
"lang": "en",
"value": "To mitigate this issue, ensure that blob keys used by Active Storage are not derived from untrusted user input. Applications should validate and sanitize any user-provided data before it is used in blob keys to prevent path traversal sequences."
}
],
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
}
],
"cna": {
"affected": [
{
"product": "activestorage",
"vendor": "rails",
"versions": [
{
"status": "affected",
"version": "\u003e= 8.1.0.beta1, \u003c 8.1.2.1"
},
{
"status": "affected",
"version": "\u003e= 8.0.0.beta1, \u003c 8.0.4.1"
},
{
"status": "affected",
"version": "\u003c 7.2.3.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Storage\u0027s `DiskService#path_for` does not validate that the resolved filesystem path remains within the storage root directory. If a blob key containing path traversal sequences (e.g. `../`) is used, it could allow reading, writing, or deleting arbitrary files on the server. Blob keys are expected to be trusted strings, but some applications could be passing user input as keys and would be affected. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-23T23:31:41.785Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/rails/rails/security/advisories/GHSA-9xrj-h377-fr87",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/rails/rails/security/advisories/GHSA-9xrj-h377-fr87"
},
{
"name": "https://github.com/rails/rails/commit/4933c1e3b8c1bb04925d60347be9f69270392f2c",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/commit/4933c1e3b8c1bb04925d60347be9f69270392f2c"
},
{
"name": "https://github.com/rails/rails/commit/9b06fbc0f504b8afe333f33d19548f3b85fbe655",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/commit/9b06fbc0f504b8afe333f33d19548f3b85fbe655"
},
{
"name": "https://github.com/rails/rails/commit/a290c8a1ec189d793aa6d7f2570b6a763f675348",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/commit/a290c8a1ec189d793aa6d7f2570b6a763f675348"
},
{
"name": "https://github.com/rails/rails/releases/tag/v7.2.3.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/releases/tag/v7.2.3.1"
},
{
"name": "https://github.com/rails/rails/releases/tag/v8.0.4.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/releases/tag/v8.0.4.1"
},
{
"name": "https://github.com/rails/rails/releases/tag/v8.1.2.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/releases/tag/v8.1.2.1"
}
],
"source": {
"advisory": "GHSA-9xrj-h377-fr87",
"discovery": "UNKNOWN"
},
"title": "Rails Active Storage has possible Path Traversal in DiskService"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-33195",
"datePublished": "2026-03-23T23:31:41.785Z",
"dateReserved": "2026-03-17T22:16:36.721Z",
"dateUpdated": "2026-06-30T12:07:37.905Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-33176 (GCVE-0-2026-33176)
Vulnerability from nvd – Published: 2026-03-23 23:29 – Updated: 2026-03-24 18:42
VLAI
EPSS
VEX
Title
Rails Active Support has a possible DoS vulnerability in its number helpers
Summary
Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Support number helpers accept strings containing scientific notation (e.g. `1e10000`), which `BigDecimal` expands into extremely large decimal representations. This can cause excessive memory allocation and CPU consumption when the expanded number is formatted, possibly resulting in a DoS vulnerability. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/rails/rails/security/advisorie… | x_refsource_CONFIRM |
| https://github.com/rails/rails/commit/19dbab51ca0… | x_refsource_MISC |
| https://github.com/rails/rails/commit/ebd6be18120… | x_refsource_MISC |
| https://github.com/rails/rails/commit/ee2c59e730e… | x_refsource_MISC |
| https://github.com/rails/rails/releases/tag/v7.2.3.1 | x_refsource_MISC |
| https://github.com/rails/rails/releases/tag/v8.0.4.1 | x_refsource_MISC |
| https://github.com/rails/rails/releases/tag/v8.1.2.1 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| rails | activesupport |
Affected:
>= 8.1.0.beta1, < 8.1.2.1
Affected: >= 8.0.0.beta1, < 8.0.4.1 Affected: < 7.2.3.1 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-33176",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-24T18:42:42.653404Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-24T18:42:48.858Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "activesupport",
"vendor": "rails",
"versions": [
{
"status": "affected",
"version": "\u003e= 8.1.0.beta1, \u003c 8.1.2.1"
},
{
"status": "affected",
"version": "\u003e= 8.0.0.beta1, \u003c 8.0.4.1"
},
{
"status": "affected",
"version": "\u003c 7.2.3.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Support number helpers accept strings containing scientific notation (e.g. `1e10000`), which `BigDecimal` expands into extremely large decimal representations. This can cause excessive memory allocation and CPU consumption when the expanded number is formatted, possibly resulting in a DoS vulnerability. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400: Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770: Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-23T23:29:27.933Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/rails/rails/security/advisories/GHSA-2j26-frm8-cmj9",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/rails/rails/security/advisories/GHSA-2j26-frm8-cmj9"
},
{
"name": "https://github.com/rails/rails/commit/19dbab51ca086a657bb86458042bc44314916bcb",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/commit/19dbab51ca086a657bb86458042bc44314916bcb"
},
{
"name": "https://github.com/rails/rails/commit/ebd6be18120d1136511eb516338e27af25ac0a1a",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/commit/ebd6be18120d1136511eb516338e27af25ac0a1a"
},
{
"name": "https://github.com/rails/rails/commit/ee2c59e730e5b8faed502cd2c573109df093f856",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/commit/ee2c59e730e5b8faed502cd2c573109df093f856"
},
{
"name": "https://github.com/rails/rails/releases/tag/v7.2.3.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/releases/tag/v7.2.3.1"
},
{
"name": "https://github.com/rails/rails/releases/tag/v8.0.4.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/releases/tag/v8.0.4.1"
},
{
"name": "https://github.com/rails/rails/releases/tag/v8.1.2.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/releases/tag/v8.1.2.1"
}
],
"source": {
"advisory": "GHSA-2j26-frm8-cmj9",
"discovery": "UNKNOWN"
},
"title": "Rails Active Support has a possible DoS vulnerability in its number helpers"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-33176",
"datePublished": "2026-03-23T23:29:27.933Z",
"dateReserved": "2026-03-17T22:16:36.719Z",
"dateUpdated": "2026-03-24T18:42:48.858Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-33174 (GCVE-0-2026-33174)
Vulnerability from nvd – Published: 2026-03-23 23:24 – Updated: 2026-03-24 13:40
VLAI
EPSS
VEX
Title
Rails Active Storage has a possible DoS vulnerability when in proxy mode via Range requests
Summary
Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, when serving files through Active Storage's proxy delivery mode, the proxy controller loads the entire requested byte range into memory before sending it. A request with a large or unbounded Range header (e.g. `bytes=0-`) could cause the server to allocate memory proportional to the file size, possibly resulting in a DoS vulnerability through memory exhaustion. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-789 - Memory Allocation with Excessive Size Value
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/rails/rails/security/advisorie… | x_refsource_CONFIRM |
| https://github.com/rails/rails/commit/2cd933c366b… | x_refsource_MISC |
| https://github.com/rails/rails/commit/42012eaaa88… | x_refsource_MISC |
| https://github.com/rails/rails/commit/8159a9c3de3… | x_refsource_MISC |
| https://github.com/rails/rails/releases/tag/v7.2.3.1 | x_refsource_MISC |
| https://github.com/rails/rails/releases/tag/v8.0.4.1 | x_refsource_MISC |
| https://github.com/rails/rails/releases/tag/v8.1.2.1 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| rails | activestorage |
Affected:
>= 8.1.0.beta1, < 8.1.2.1
Affected: >= 8.0.0.beta1, < 8.0.4.1 Affected: < 7.2.3.1 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-33174",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-24T13:40:23.185319Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-24T13:40:32.031Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "activestorage",
"vendor": "rails",
"versions": [
{
"status": "affected",
"version": "\u003e= 8.1.0.beta1, \u003c 8.1.2.1"
},
{
"status": "affected",
"version": "\u003e= 8.0.0.beta1, \u003c 8.0.4.1"
},
{
"status": "affected",
"version": "\u003c 7.2.3.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, when serving files through Active Storage\u0027s proxy delivery mode, the proxy controller loads the entire requested byte range into memory before sending it. A request with a large or unbounded Range header (e.g. `bytes=0-`) could cause the server to allocate memory proportional to the file size, possibly resulting in a DoS vulnerability through memory exhaustion. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-789",
"description": "CWE-789: Memory Allocation with Excessive Size Value",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-23T23:25:23.363Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/rails/rails/security/advisories/GHSA-r46p-8f7g-vvvg",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/rails/rails/security/advisories/GHSA-r46p-8f7g-vvvg"
},
{
"name": "https://github.com/rails/rails/commit/2cd933c366b777f873d4d590127da2f4a25e4ba5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/commit/2cd933c366b777f873d4d590127da2f4a25e4ba5"
},
{
"name": "https://github.com/rails/rails/commit/42012eaaa88dfc7d0030161b2bc8074a7bbce92a",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/commit/42012eaaa88dfc7d0030161b2bc8074a7bbce92a"
},
{
"name": "https://github.com/rails/rails/commit/8159a9c3de3f27a2bcf2866b8bf9ceb9075e229b",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/commit/8159a9c3de3f27a2bcf2866b8bf9ceb9075e229b"
},
{
"name": "https://github.com/rails/rails/releases/tag/v7.2.3.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/releases/tag/v7.2.3.1"
},
{
"name": "https://github.com/rails/rails/releases/tag/v8.0.4.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/releases/tag/v8.0.4.1"
},
{
"name": "https://github.com/rails/rails/releases/tag/v8.1.2.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/releases/tag/v8.1.2.1"
}
],
"source": {
"advisory": "GHSA-r46p-8f7g-vvvg",
"discovery": "UNKNOWN"
},
"title": "Rails Active Storage has a possible DoS vulnerability when in proxy mode via Range requests"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-33174",
"datePublished": "2026-03-23T23:24:55.594Z",
"dateReserved": "2026-03-17T22:16:36.719Z",
"dateUpdated": "2026-03-24T13:40:32.031Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-33173 (GCVE-0-2026-33173)
Vulnerability from nvd – Published: 2026-03-23 23:21 – Updated: 2026-03-24 15:12
VLAI
EPSS
VEX
Title
Rails Active Storage has possible content type bypass via metadata in direct uploads
Summary
Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, `DirectUploadsController` accepts arbitrary metadata from the client and persists it on the blob. Because internal flags like `identified` and `analyzed` are stored in the same metadata hash, a direct-upload client can set these flags to skip MIME detection and analysis. This allows an attacker to upload arbitrary content while claiming a safe `content_type`, bypassing any validations that rely on Active Storage's automatic content type identification. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-925 - Improper Verification of Intent by Broadcast Receiver
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/rails/rails/security/advisorie… | x_refsource_CONFIRM |
| https://github.com/rails/rails/commit/707c0f1f41f… | x_refsource_MISC |
| https://github.com/rails/rails/commit/8fcb934caad… | x_refsource_MISC |
| https://github.com/rails/rails/commit/d9502f5214e… | x_refsource_MISC |
| https://github.com/rails/rails/releases/tag/v7.2.3.1 | x_refsource_MISC |
| https://github.com/rails/rails/releases/tag/v8.0.4.1 | x_refsource_MISC |
| https://github.com/rails/rails/releases/tag/v8.1.2.1 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| rails | activestorage |
Affected:
>= 8.1.0.beta1, < 8.1.2.1
Affected: >= 8.0.0.beta1, < 8.0.4.1 Affected: < 7.2.3.1 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-33173",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-24T14:14:22.499615Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-24T15:12:50.569Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "activestorage",
"vendor": "rails",
"versions": [
{
"status": "affected",
"version": "\u003e= 8.1.0.beta1, \u003c 8.1.2.1"
},
{
"status": "affected",
"version": "\u003e= 8.0.0.beta1, \u003c 8.0.4.1"
},
{
"status": "affected",
"version": "\u003c 7.2.3.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, `DirectUploadsController` accepts arbitrary metadata from the client and persists it on the blob. Because internal flags like `identified` and `analyzed` are stored in the same metadata hash, a direct-upload client can set these flags to skip MIME detection and analysis. This allows an attacker to upload arbitrary content while claiming a safe `content_type`, bypassing any validations that rely on Active Storage\u0027s automatic content type identification. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-925",
"description": "CWE-925: Improper Verification of Intent by Broadcast Receiver",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-23T23:21:29.843Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/rails/rails/security/advisories/GHSA-qcfx-2mfw-w4cg",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/rails/rails/security/advisories/GHSA-qcfx-2mfw-w4cg"
},
{
"name": "https://github.com/rails/rails/commit/707c0f1f41f067fdf96d54e99d43b28dfaae7e53",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/commit/707c0f1f41f067fdf96d54e99d43b28dfaae7e53"
},
{
"name": "https://github.com/rails/rails/commit/8fcb934caadc79c8cc4ce53287046d0f67005b3e",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/commit/8fcb934caadc79c8cc4ce53287046d0f67005b3e"
},
{
"name": "https://github.com/rails/rails/commit/d9502f5214e2198245a4c1defe9cd02a7c8057d0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/commit/d9502f5214e2198245a4c1defe9cd02a7c8057d0"
},
{
"name": "https://github.com/rails/rails/releases/tag/v7.2.3.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/releases/tag/v7.2.3.1"
},
{
"name": "https://github.com/rails/rails/releases/tag/v8.0.4.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/releases/tag/v8.0.4.1"
},
{
"name": "https://github.com/rails/rails/releases/tag/v8.1.2.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/releases/tag/v8.1.2.1"
}
],
"source": {
"advisory": "GHSA-qcfx-2mfw-w4cg",
"discovery": "UNKNOWN"
},
"title": "Rails Active Storage has possible content type bypass via metadata in direct uploads"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-33173",
"datePublished": "2026-03-23T23:21:29.843Z",
"dateReserved": "2026-03-17T22:16:36.719Z",
"dateUpdated": "2026-03-24T15:12:50.569Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-33170 (GCVE-0-2026-33170)
Vulnerability from nvd – Published: 2026-03-23 23:09 – Updated: 2026-03-25 19:20
VLAI
EPSS
VEX
Title
Rails Active Support has a possible XSS vulnerability in SafeBuffer#%
Summary
Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, `SafeBuffer#%` does not propagate the `@html_unsafe` flag to the newly created buffer. If a `SafeBuffer` is mutated in place (e.g. via `gsub!`) and then formatted with `%` using untrusted arguments, the result incorrectly reports `html_safe? == true`, bypassing ERB auto-escaping and possibly leading to XSS. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/rails/rails/security/advisorie… | x_refsource_CONFIRM |
| https://github.com/rails/rails/commit/50d732af3b7… | x_refsource_MISC |
| https://github.com/rails/rails/commit/6e8a8110800… | x_refsource_MISC |
| https://github.com/rails/rails/commit/c1ad0e8e197… | x_refsource_MISC |
| https://github.com/rails/rails/releases/tag/v7.2.3.1 | x_refsource_MISC |
| https://github.com/rails/rails/releases/tag/v8.0.4.1 | x_refsource_MISC |
| https://github.com/rails/rails/releases/tag/v8.1.2.1 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| rails | activesupport |
Affected:
>= 8.1.0.beta1, < 8.1.2.1
Affected: >= 8.0.0.beta1, < 8.0.4.1 Affected: < 7.2.3.1 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-33170",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-25T19:20:16.086015Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T19:20:28.280Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "activesupport",
"vendor": "rails",
"versions": [
{
"status": "affected",
"version": "\u003e= 8.1.0.beta1, \u003c 8.1.2.1"
},
{
"status": "affected",
"version": "\u003e= 8.0.0.beta1, \u003c 8.0.4.1"
},
{
"status": "affected",
"version": "\u003c 7.2.3.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, `SafeBuffer#%` does not propagate the `@html_unsafe` flag to the newly created buffer. If a `SafeBuffer` is mutated in place (e.g. via `gsub!`) and then formatted with `%` using untrusted arguments, the result incorrectly reports `html_safe? == true`, bypassing ERB auto-escaping and possibly leading to XSS. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-23T23:19:36.467Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/rails/rails/security/advisories/GHSA-89vf-4333-qx8v",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/rails/rails/security/advisories/GHSA-89vf-4333-qx8v"
},
{
"name": "https://github.com/rails/rails/commit/50d732af3b7c8aaf63cbcca0becbc00279b215b7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/commit/50d732af3b7c8aaf63cbcca0becbc00279b215b7"
},
{
"name": "https://github.com/rails/rails/commit/6e8a81108001d58043de9e54a06fca58962fc2db",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/commit/6e8a81108001d58043de9e54a06fca58962fc2db"
},
{
"name": "https://github.com/rails/rails/commit/c1ad0e8e1972032f3395853a5e99cea035035beb",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/commit/c1ad0e8e1972032f3395853a5e99cea035035beb"
},
{
"name": "https://github.com/rails/rails/releases/tag/v7.2.3.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/releases/tag/v7.2.3.1"
},
{
"name": "https://github.com/rails/rails/releases/tag/v8.0.4.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/releases/tag/v8.0.4.1"
},
{
"name": "https://github.com/rails/rails/releases/tag/v8.1.2.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/releases/tag/v8.1.2.1"
}
],
"source": {
"advisory": "GHSA-89vf-4333-qx8v",
"discovery": "UNKNOWN"
},
"title": "Rails Active Support has a possible XSS vulnerability in SafeBuffer#%"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-33170",
"datePublished": "2026-03-23T23:09:48.923Z",
"dateReserved": "2026-03-17T21:17:08.888Z",
"dateUpdated": "2026-03-25T19:20:28.280Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-33169 (GCVE-0-2026-33169)
Vulnerability from nvd – Published: 2026-03-23 23:07 – Updated: 2026-03-24 15:46
VLAI
EPSS
VEX
Title
Rails Active Support has a possible ReDoS vulnerability in number_to_delimited
Summary
Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. `NumberToDelimitedConverter` uses a lookahead-based regular expression with `gsub!` to insert thousands delimiters. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, the interaction between the repeated lookahead group and `gsub!` can produce quadratic time complexity on long digit strings. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/rails/rails/security/advisorie… | x_refsource_CONFIRM |
| https://github.com/rails/rails/commit/29154f1097d… | x_refsource_MISC |
| https://github.com/rails/rails/commit/b54a4b373c6… | x_refsource_MISC |
| https://github.com/rails/rails/commit/ec1a0e215ef… | x_refsource_MISC |
| https://github.com/rails/rails/releases/tag/v7.2.3.1 | x_refsource_MISC |
| https://github.com/rails/rails/releases/tag/v8.0.4.1 | x_refsource_MISC |
| https://github.com/rails/rails/releases/tag/v8.1.2.1 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| rails | activesupport |
Affected:
>= 8.1.0.beta1, < 8.1.2.1
Affected: >= 8.0.0.beta1, < 8.0.4.1 Affected: < 7.2.3.1 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-33169",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-24T15:45:49.354964Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-24T15:46:43.465Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "activesupport",
"vendor": "rails",
"versions": [
{
"status": "affected",
"version": "\u003e= 8.1.0.beta1, \u003c 8.1.2.1"
},
{
"status": "affected",
"version": "\u003e= 8.0.0.beta1, \u003c 8.0.4.1"
},
{
"status": "affected",
"version": "\u003c 7.2.3.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. `NumberToDelimitedConverter` uses a lookahead-based regular expression with `gsub!` to insert thousands delimiters. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, the interaction between the repeated lookahead group and `gsub!` can produce quadratic time complexity on long digit strings. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400: Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-1333",
"description": "CWE-1333: Inefficient Regular Expression Complexity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-23T23:19:24.387Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/rails/rails/security/advisories/GHSA-cg4j-q9v8-6v38",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/rails/rails/security/advisories/GHSA-cg4j-q9v8-6v38"
},
{
"name": "https://github.com/rails/rails/commit/29154f1097da13d48fdb3200760b3e3da66dcb11",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/commit/29154f1097da13d48fdb3200760b3e3da66dcb11"
},
{
"name": "https://github.com/rails/rails/commit/b54a4b373c6f042cab6ee2033246b1c9ecc38974",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/commit/b54a4b373c6f042cab6ee2033246b1c9ecc38974"
},
{
"name": "https://github.com/rails/rails/commit/ec1a0e215efd27a3b3911aae6df978a80f456a49",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/commit/ec1a0e215efd27a3b3911aae6df978a80f456a49"
},
{
"name": "https://github.com/rails/rails/releases/tag/v7.2.3.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/releases/tag/v7.2.3.1"
},
{
"name": "https://github.com/rails/rails/releases/tag/v8.0.4.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/releases/tag/v8.0.4.1"
},
{
"name": "https://github.com/rails/rails/releases/tag/v8.1.2.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/releases/tag/v8.1.2.1"
}
],
"source": {
"advisory": "GHSA-cg4j-q9v8-6v38",
"discovery": "UNKNOWN"
},
"title": "Rails Active Support has a possible ReDoS vulnerability in number_to_delimited"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-33169",
"datePublished": "2026-03-23T23:07:07.630Z",
"dateReserved": "2026-03-17T21:17:08.888Z",
"dateUpdated": "2026-03-24T15:46:43.465Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-33168 (GCVE-0-2026-33168)
Vulnerability from nvd – Published: 2026-03-23 23:01 – Updated: 2026-03-24 13:36
VLAI
EPSS
VEX
Title
Rails has a possible XSS vulnerability in its Action View tag helpers
Summary
Action View provides conventions and helpers for building web pages with the Rails framework. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, when a blank string is used as an HTML attribute name in Action View tag helpers, the attribute escaping is bypassed, producing malformed HTML. A carefully crafted attribute value could then be misinterpreted by the browser as a separate attribute name, possibly leading to XSS. Applications that allow users to specify custom HTML attributes are affected. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/rails/rails/security/advisorie… | x_refsource_CONFIRM |
| https://github.com/rails/rails/commit/0b6f8002b52… | x_refsource_MISC |
| https://github.com/rails/rails/commit/63f5ad83eda… | x_refsource_MISC |
| https://github.com/rails/rails/commit/c79a07df1e8… | x_refsource_MISC |
| https://github.com/rails/rails/releases/tag/v7.2.3.1 | x_refsource_MISC |
| https://github.com/rails/rails/releases/tag/v8.0.4.1 | x_refsource_MISC |
| https://github.com/rails/rails/releases/tag/v8.1.2.1 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| rails | actionview |
Affected:
>= 8.1.0.beta1, < 8.1.2.1
Affected: >= 8.0.0.beta1, < 8.0.4.1 Affected: < 7.2.3.1 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-33168",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-24T13:36:28.555604Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-24T13:36:44.829Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "actionview",
"vendor": "rails",
"versions": [
{
"status": "affected",
"version": "\u003e= 8.1.0.beta1, \u003c 8.1.2.1"
},
{
"status": "affected",
"version": "\u003e= 8.0.0.beta1, \u003c 8.0.4.1"
},
{
"status": "affected",
"version": "\u003c 7.2.3.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Action View provides conventions and helpers for building web pages with the Rails framework. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, when a blank string is used as an HTML attribute name in Action View tag helpers, the attribute escaping is bypassed, producing malformed HTML. A carefully crafted attribute value could then be misinterpreted by the browser as a separate attribute name, possibly leading to XSS. Applications that allow users to specify custom HTML attributes are affected. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.3,
"baseSeverity": "LOW",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-23T23:19:11.173Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/rails/rails/security/advisories/GHSA-v55j-83pf-r9cq",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/rails/rails/security/advisories/GHSA-v55j-83pf-r9cq"
},
{
"name": "https://github.com/rails/rails/commit/0b6f8002b52b9c606fd6be9e7915d9f944cf539c",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/commit/0b6f8002b52b9c606fd6be9e7915d9f944cf539c"
},
{
"name": "https://github.com/rails/rails/commit/63f5ad83edaa0b976f82d46988d745426aa4a42d",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/commit/63f5ad83edaa0b976f82d46988d745426aa4a42d"
},
{
"name": "https://github.com/rails/rails/commit/c79a07df1e88738df8f68cb0ee759ad6128ca924",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/commit/c79a07df1e88738df8f68cb0ee759ad6128ca924"
},
{
"name": "https://github.com/rails/rails/releases/tag/v7.2.3.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/releases/tag/v7.2.3.1"
},
{
"name": "https://github.com/rails/rails/releases/tag/v8.0.4.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/releases/tag/v8.0.4.1"
},
{
"name": "https://github.com/rails/rails/releases/tag/v8.1.2.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/releases/tag/v8.1.2.1"
}
],
"source": {
"advisory": "GHSA-v55j-83pf-r9cq",
"discovery": "UNKNOWN"
},
"title": "Rails has a possible XSS vulnerability in its Action View tag helpers"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-33168",
"datePublished": "2026-03-23T23:01:22.019Z",
"dateReserved": "2026-03-17T21:17:08.888Z",
"dateUpdated": "2026-03-24T13:36:44.829Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-33167 (GCVE-0-2026-33167)
Vulnerability from nvd – Published: 2026-03-23 22:58 – Updated: 2026-03-24 18:44
VLAI
EPSS
VEX
Title
Rails has a possible XSS vulnerability in its Action Pack debug exceptions
Summary
Action Pack is a Rubygem for building web applications on the Rails framework. In versions on the 8.1 branch prior to 8.1.2.1, the debug exceptions page does not properly escape exception messages. A carefully crafted exception message could inject arbitrary HTML and JavaScript into the page, leading to XSS. This affects applications with detailed exception pages enabled (`config.consider_all_requests_local = true`), which is the default in development. Version 8.1.2.1 contains a patch.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/rails/rails/security/advisorie… | x_refsource_CONFIRM |
| https://github.com/rails/rails/commit/6752711c8c3… | x_refsource_MISC |
| https://github.com/rails/rails/releases/tag/v8.1.2.1 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| rails | actionpack |
Affected:
>= 8.1.0, < 8.1.2.1
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-33167",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-24T18:44:05.658370Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-24T18:44:13.020Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "actionpack",
"vendor": "rails",
"versions": [
{
"status": "affected",
"version": "\u003e= 8.1.0, \u003c 8.1.2.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Action Pack is a Rubygem for building web applications on the Rails framework. In versions on the 8.1 branch prior to 8.1.2.1, the debug exceptions page does not properly escape exception messages. A carefully crafted exception message could inject arbitrary HTML and JavaScript into the page, leading to XSS. This affects applications with detailed exception pages enabled (`config.consider_all_requests_local = true`), which is the default in development. Version 8.1.2.1 contains a patch."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 1.3,
"baseSeverity": "LOW",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-23T23:18:56.415Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/rails/rails/security/advisories/GHSA-pgm4-439c-5jp6",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/rails/rails/security/advisories/GHSA-pgm4-439c-5jp6"
},
{
"name": "https://github.com/rails/rails/commit/6752711c8c31d79ba50d13af6a6698a3b85415e0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/commit/6752711c8c31d79ba50d13af6a6698a3b85415e0"
},
{
"name": "https://github.com/rails/rails/releases/tag/v8.1.2.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/releases/tag/v8.1.2.1"
}
],
"source": {
"advisory": "GHSA-pgm4-439c-5jp6",
"discovery": "UNKNOWN"
},
"title": "Rails has a possible XSS vulnerability in its Action Pack debug exceptions"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-33167",
"datePublished": "2026-03-23T22:58:53.577Z",
"dateReserved": "2026-03-17T21:17:08.888Z",
"dateUpdated": "2026-03-24T18:44:13.020Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-24293 (GCVE-0-2025-24293)
Vulnerability from nvd – Published: 2026-01-30 20:11 – Updated: 2026-06-30 12:07
VLAI
EPSS
VEX
Summary
# Active Storage allowed transformation methods potentially unsafe
Active Storage attempts to prevent the use of potentially unsafe image
transformation methods and parameters by default.
The default allowed list contains three methods allow for the circumvention
of the safe defaults which enables potential command injection
vulnerabilities in cases where arbitrary user supplied input is accepted as
valid transformation methods or parameters.
Impact
------
This vulnerability impacts applications that use Active Storage with the image_processing processing gem in addition to mini_magick as the image processor.
Vulnerable code will look something similar to this:
```
<%= image_tag blob.variant(params[:t] => params[:v]) %>
```
Where the transformation method or its arguments are untrusted arbitrary input.
All users running an affected release should either upgrade or use one of the workarounds immediately.
Workarounds
-----------
Consuming user supplied input for image transformation methods or their parameters is unsupported behavior and should be considered dangerous.
Strict validation of user supplied methods and parameters should be performed
as well as having a strong [ImageMagick security
policy](https://imagemagick.org/script/security-policy.php) deployed.
Credits
-------
Thank you [lio346](https://hackerone.com/lio346) for reporting this!
Severity
8.1 (High)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/advisories/GHSA-r4mg-4433-c7g3 | |
| https://access.redhat.com/security/cve/CVE-2025-24293 | vdb-entryx_refsource_REDHAT |
| https://bugzilla.redhat.com/show_bug.cgi?id=2435565 | issue-trackingx_refsource_REDHAT |
| https://security.access.redhat.com/data/csaf/v2/v… | x_sadp-csaf-vex |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Rails | activestorage |
Affected:
5.2 , < 5.*
(semver)
Affected: 7.0 , < 7.1.5.2 (semver) Affected: 8.0 , < 7.0.2.1 (semver) |
|
| Red Hat | Red Hat 3scale API Management Platform 2 |
cpe:/a:redhat:red_hat_3scale_amp:2 |
|
| Red Hat | Red Hat Satellite 6 |
cpe:/a:redhat:satellite:6 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-24293",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-02-02T14:45:32.482487Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "CWE-77 Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-02-02T14:47:12.620Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"affected": [
{
"cpes": [
"cpe:/a:redhat:red_hat_3scale_amp:2"
],
"defaultStatus": "unaffected",
"product": "Red Hat 3scale API Management Platform 2",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:satellite:6"
],
"defaultStatus": "unaffected",
"product": "Red Hat Satellite 6",
"vendor": "Red Hat"
}
],
"datePublic": "2026-01-30T20:11:15.219Z",
"descriptions": [
{
"lang": "en",
"value": "Active Storage attempts to prevent the use of potentially unsafe image transformation methods and parameters by default. The default allowed list contains three methods allowing for the circumvention of the safe defaults which enables potential command injection vulnerabilities in cases where arbitrary user supplied input is accepted as valid transformation methods or parameters. This vulnerability impacts applications that use Active Storage with the image_processing processing gem in addition to mini_magick as the image processor."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-88",
"description": "Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-30T12:07:21.225Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2025-24293"
},
{
"name": "RHBZ#2435565",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2435565"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-24293.json"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-01-30T21:01:14.441Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-01-30T20:11:15.219Z",
"value": "Made public."
}
],
"title": "activestorage: Code injection in Active Storage when used in conjunction with the image_processing gem",
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "activestorage",
"vendor": "Rails",
"versions": [
{
"lessThan": "5.*",
"status": "affected",
"version": "5.2",
"versionType": "semver"
},
{
"lessThan": "7.1.5.2",
"status": "affected",
"version": "7.0",
"versionType": "semver"
},
{
"lessThan": "7.0.2.1",
"status": "affected",
"version": "8.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "# Active Storage allowed transformation methods potentially unsafe\r\n\r\nActive Storage attempts to prevent the use of potentially unsafe image\r\ntransformation methods and parameters by default.\r\n\r\nThe default allowed list contains three methods allow for the circumvention\r\nof the safe defaults which enables potential command injection\r\nvulnerabilities in cases where arbitrary user supplied input is accepted as\r\nvalid transformation methods or parameters.\r\n\r\n\r\nImpact\r\n------\r\nThis vulnerability impacts applications that use Active Storage with the image_processing processing gem in addition to mini_magick as the image processor.\r\n\r\nVulnerable code will look something similar to this:\r\n```\r\n\u003c%= image_tag blob.variant(params[:t] =\u003e params[:v]) %\u003e\r\n```\r\n\r\nWhere the transformation method or its arguments are untrusted arbitrary input.\r\n\r\nAll users running an affected release should either upgrade or use one of the workarounds immediately.\r\n\r\n\r\n\r\nWorkarounds\r\n-----------\r\nConsuming user supplied input for image transformation methods or their parameters is unsupported behavior and should be considered dangerous.\r\n\r\nStrict validation of user supplied methods and parameters should be performed\r\nas well as having a strong [ImageMagick security\r\npolicy](https://imagemagick.org/script/security-policy.php) deployed.\r\n\r\nCredits\r\n-------\r\n\r\nThank you [lio346](https://hackerone.com/lio346) for reporting this!"
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 9.2,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-01-30T20:11:15.219Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://github.com/advisories/GHSA-r4mg-4433-c7g3"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2025-24293",
"datePublished": "2026-01-30T20:11:15.219Z",
"dateReserved": "2025-01-17T01:00:07.458Z",
"dateUpdated": "2026-06-30T12:07:21.225Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-55193 (GCVE-0-2025-55193)
Vulnerability from nvd – Published: 2025-08-13 22:41 – Updated: 2025-08-14 14:51
VLAI
EPSS
VEX
Title
Active Record logging vulnerable to ANSI escape injection
Summary
Active Record connects classes to relational database tables. Prior to versions 7.1.5.2, 7.2.2.2, and 8.0.2.1, the ID passed to find or similar methods may be logged without escaping. If this is directly to the terminal it may include unescaped ANSI sequences. This issue has been patched in versions 7.1.5.2, 7.2.2.2, and 8.0.2.1.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-150 - Improper Neutralization of Escape, Meta, or Control Sequences
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/rails/rails/security/advisorie… | x_refsource_CONFIRM |
| https://github.com/rails/rails/commit/3beef200137… | x_refsource_MISC |
| https://github.com/rails/rails/commit/568c0bc2f1e… | x_refsource_MISC |
| https://github.com/rails/rails/commit/6a944ca4805… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-55193",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-08-14T13:42:07.857418Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-08-14T14:51:11.284Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "rails",
"vendor": "rails",
"versions": [
{
"status": "affected",
"version": "\u003e= 0, \u003c 7.1.5.2"
},
{
"status": "affected",
"version": "\u003e= 7.2, \u003c 7.2.2.2"
},
{
"status": "affected",
"version": "\u003e= 8.0, \u003c 8.0.2.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Active Record connects classes to relational database tables. Prior to versions 7.1.5.2, 7.2.2.2, and 8.0.2.1, the ID passed to find or similar methods may be logged without escaping. If this is directly to the terminal it may include unescaped ANSI sequences. This issue has been patched in versions 7.1.5.2, 7.2.2.2, and 8.0.2.1."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 2.7,
"baseSeverity": "LOW",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:U",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-150",
"description": "CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-08-13T22:41:41.890Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/rails/rails/security/advisories/GHSA-76r7-hhxj-r776",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/rails/rails/security/advisories/GHSA-76r7-hhxj-r776"
},
{
"name": "https://github.com/rails/rails/commit/3beef20013736fd52c5dcfdf061f7999ba318290",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/commit/3beef20013736fd52c5dcfdf061f7999ba318290"
},
{
"name": "https://github.com/rails/rails/commit/568c0bc2f1e74c65d150a84b89a080949bf9eb9b",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/commit/568c0bc2f1e74c65d150a84b89a080949bf9eb9b"
},
{
"name": "https://github.com/rails/rails/commit/6a944ca4805e72050a0fbb1a461534eb760d3202",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/commit/6a944ca4805e72050a0fbb1a461534eb760d3202"
}
],
"source": {
"advisory": "GHSA-76r7-hhxj-r776",
"discovery": "UNKNOWN"
},
"title": "Active Record logging vulnerable to ANSI escape injection"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2025-55193",
"datePublished": "2025-08-13T22:41:41.890Z",
"dateReserved": "2025-08-08T21:55:07.963Z",
"dateUpdated": "2025-08-14T14:51:11.284Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-38037 (GCVE-0-2023-38037)
Vulnerability from nvd – Published: 2025-01-09 00:33 – Updated: 2025-02-15 00:10
VLAI
EPSS
VEX
Summary
ActiveSupport::EncryptedFile writes contents that will be encrypted to a
temporary file. The temporary file's permissions are defaulted to the user's
current `umask` settings, meaning that it's possible for other users on the
same system to read the contents of the temporary file.
Attackers that have access to the file system could possibly read the contents
of this temporary file while a user is editing it.
All users running an affected release should either upgrade or use one of the
workarounds immediately.
Severity
5.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-732 - Incorrect Permission Assignment for Critical Resource
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Rails | ActiveSupport |
Affected:
>= 5.2.0 , < >= 5.2.0
(custom)
Unaffected: 5.2.0 , < 5.2.0 (semver) Unaffected: 7.0.7.1, 6.1.7.5 , < 7.0.7.1, 6.1.7.5 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-38037",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-01-09T21:35:42.283546Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-732",
"description": "CWE-732 Incorrect Permission Assignment for Critical Resource",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-01-09T21:36:28.951Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-02-15T00:10:27.790Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "https://security.netapp.com/advisory/ntap-20250214-0010/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "ActiveSupport",
"vendor": "Rails",
"versions": [
{
"lessThan": "\u003e= 5.2.0",
"status": "affected",
"version": "\u003e= 5.2.0",
"versionType": "custom"
},
{
"lessThan": "5.2.0",
"status": "unaffected",
"version": "5.2.0",
"versionType": "semver"
},
{
"lessThan": "7.0.7.1, 6.1.7.5",
"status": "unaffected",
"version": "7.0.7.1, 6.1.7.5",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ActiveSupport::EncryptedFile writes contents that will be encrypted to a\r\ntemporary file. The temporary file\u0027s permissions are defaulted to the user\u0027s\r\ncurrent `umask` settings, meaning that it\u0027s possible for other users on the\r\nsame system to read the contents of the temporary file.\r\n\r\nAttackers that have access to the file system could possibly read the contents\r\nof this temporary file while a user is editing it.\r\n\r\nAll users running an affected release should either upgrade or use one of the\r\nworkarounds immediately."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:L",
"version": "3.0"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-01-09T00:33:47.704Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://discuss.rubyonrails.org/t/cve-2023-38037-possible-file-disclosure-of-locally-encrypted-files/83544"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2023-38037",
"datePublished": "2025-01-09T00:33:47.704Z",
"dateReserved": "2023-07-12T01:00:11.881Z",
"dateUpdated": "2025-02-15T00:10:27.790Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-28362 (GCVE-0-2023-28362)
Vulnerability from nvd – Published: 2025-01-09 00:33 – Updated: 2025-05-02 23:02
VLAI
EPSS
VEX
Summary
The redirect_to method in Rails allows provided values to contain characters which are not legal in an HTTP header value. This results in the potential for downstream services which enforce RFC compliance on HTTP response headers to remove the assigned Location header.
Severity
4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-116 - Improper Encoding or Escaping of Output
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Rails | Action Pack |
Affected:
7.0.5.1 , < 7.0.5.1
(custom)
Affected: 6.1.7.4 , < 6.1.7.4 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2023-28362",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-01-09T21:26:42.827377Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-116",
"description": "CWE-116 Improper Encoding or Escaping of Output",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-01-09T21:28:00.488Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-05-02T23:02:56.188Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "https://security.netapp.com/advisory/ntap-20250502-0009/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Action Pack",
"vendor": "Rails",
"versions": [
{
"lessThan": "7.0.5.1",
"status": "affected",
"version": "7.0.5.1",
"versionType": "custom"
},
{
"lessThan": "6.1.7.4",
"status": "affected",
"version": "6.1.7.4",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The redirect_to method in Rails allows provided values to contain characters which are not legal in an HTTP header value. This results in the potential for downstream services which enforce RFC compliance on HTTP response headers to remove the assigned Location header."
}
],
"providerMetadata": {
"dateUpdated": "2025-01-09T00:33:47.730Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://discuss.rubyonrails.org/t/cve-2023-28362-possible-xss-via-user-supplied-values-to-redirect-to/83132"
},
{
"url": "https://github.com/advisories/GHSA-4g8v-vg43-wpgf"
},
{
"url": "https://github.com/rails/rails/commit/1c3f93d1e90a3475f9ae2377ead25ccf11f71441"
},
{
"url": "https://github.com/rails/rails/commit/69e37c84e3f77d75566424c7d0015172d6a6fac5"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2023-28362",
"datePublished": "2025-01-09T00:33:47.730Z",
"dateReserved": "2023-03-15T01:00:13.221Z",
"dateUpdated": "2025-05-02T23:02:56.188Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-28120 (GCVE-0-2023-28120)
Vulnerability from nvd – Published: 2025-01-09 00:33 – Updated: 2025-01-09 21:46
VLAI
EPSS
VEX
Summary
There is a vulnerability in ActiveSupport if the new bytesplice method is called on a SafeBuffer with untrusted user input.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
6 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Rails | ActiveSupport |
Affected:
7.0.4.3 , < 7.0.4.3
(custom)
Affected: 6.1.7.3 , < 6.1.7.3 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2023-28120",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-01-09T21:44:02.886065Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-01-09T21:46:38.220Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "ActiveSupport",
"vendor": "Rails",
"versions": [
{
"lessThan": "7.0.4.3",
"status": "affected",
"version": "7.0.4.3",
"versionType": "custom"
},
{
"lessThan": "6.1.7.3",
"status": "affected",
"version": "6.1.7.3",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "There is a vulnerability in ActiveSupport if the new bytesplice method is called on a SafeBuffer with untrusted user input."
}
],
"providerMetadata": {
"dateUpdated": "2025-01-09T00:33:47.658Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://discuss.rubyonrails.org/t/cve-2023-28120-possible-xss-security-vulnerability-in-safebuffer-bytesplice/82469"
},
{
"url": "https://github.com/rails/rails/commit/3cf23c3f891e2e81c977ea4ab83b62bc2a444b70"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UPV6PVCX4VDJHLFFT42EXBBSGAWZICOW/"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZE5W4MH6IE4DV7GELDK6ISCSTFLHKSYO/"
},
{
"url": "https://security.netapp.com/advisory/ntap-20240202-0006/"
},
{
"url": "https://www.debian.org/security/2023/dsa-5389"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2023-28120",
"datePublished": "2025-01-09T00:33:47.658Z",
"dateReserved": "2023-03-10T19:36:27.051Z",
"dateUpdated": "2025-01-09T21:46:38.220Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-27539 (GCVE-0-2023-27539)
Vulnerability from nvd – Published: 2025-01-09 00:33 – Updated: 2025-01-09 21:24
VLAI
EPSS
VEX
Summary
There is a denial of service vulnerability in the header parsing component of Rack.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
7 references
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2023-27539",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-01-09T21:22:46.686498Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-noinfo Not enough information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-01-09T21:24:51.396Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Rack",
"vendor": "Rails",
"versions": [
{
"lessThan": "2.2.6.4",
"status": "affected",
"version": "2.2.6.4",
"versionType": "custom"
},
{
"lessThan": "3.0.6.1",
"status": "affected",
"version": "3.0.6.1",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "There is a denial of service vulnerability in the header parsing component of Rack."
}
],
"providerMetadata": {
"dateUpdated": "2025-01-09T00:33:47.737Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://discuss.rubyonrails.org/t/cve-2023-27539-possible-denial-of-service-vulnerability-in-racks-header-parsing/82466"
},
{
"url": "https://github.com/advisories/GHSA-c6qg-cjj8-47qp"
},
{
"url": "https://github.com/rack/rack/commit/231ef369ad0b542575fb36c74fcfcfabcf6c530c"
},
{
"url": "https://github.com/rack/rack/commit/ee7919ea04303717858be1c3f16b406adc6d8cff"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2023/04/msg00017.html"
},
{
"url": "https://security.netapp.com/advisory/ntap-20231208-0016/"
},
{
"url": "https://www.debian.org/security/2023/dsa-5530"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2023-27539",
"datePublished": "2025-01-09T00:33:47.737Z",
"dateReserved": "2023-03-02T17:14:03.403Z",
"dateUpdated": "2025-01-09T21:24:51.396Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-27531 (GCVE-0-2023-27531)
Vulnerability from nvd – Published: 2025-01-09 00:33 – Updated: 2025-01-09 21:21
VLAI
EPSS
VEX
Summary
There is a deserialization of untrusted data vulnerability in the Kredis JSON deserialization code
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-502 - Deserialization of Untrusted Data
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Rails | Kredis JSON |
Affected:
1.3.0.1 , < 1.3.0.1
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2023-27531",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-01-09T21:12:26.237802Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "CWE-502 Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-01-09T21:21:36.117Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Kredis JSON",
"vendor": "Rails",
"versions": [
{
"lessThan": "1.3.0.1",
"status": "affected",
"version": "1.3.0.1",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "There is a deserialization of untrusted data vulnerability in the Kredis JSON deserialization code"
}
],
"providerMetadata": {
"dateUpdated": "2025-01-09T00:33:47.739Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://discuss.rubyonrails.org/t/cve-2023-27531-possible-deserialization-of-untrusted-data-vulnerability-in-kredis-json/82467"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2023-27531",
"datePublished": "2025-01-09T00:33:47.739Z",
"dateReserved": "2023-03-02T17:14:03.402Z",
"dateUpdated": "2025-01-09T21:21:36.117Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-23913 (GCVE-0-2023-23913)
Vulnerability from nvd – Published: 2025-01-09 00:33 – Updated: 2025-01-09 17:09
VLAI
EPSS
VEX
Summary
There is a potential DOM based cross-site scripting issue in rails-ujs which leverages the Clipboard API to target HTML elements that are assigned the contenteditable attribute. This has the potential to occur when pasting malicious HTML content from the clipboard that includes a data-method, data-remote or data-disable-with attribute.
Severity
6.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2023-23913",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-01-09T17:07:37.883185Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-01-09T17:09:39.091Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "rails-ujs",
"vendor": "Rails",
"versions": [
{
"lessThan": "6.1.7.3",
"status": "affected",
"version": "6.1.7.3",
"versionType": "custom"
},
{
"lessThan": "7.0.4.3",
"status": "affected",
"version": "7.0.4.3",
"versionType": "custom"
},
{
"lessThan": "5.1.0",
"status": "unaffected",
"version": "5.1.0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "There is a potential DOM based cross-site scripting issue in rails-ujs which leverages the Clipboard API to target HTML elements that are assigned the contenteditable attribute. This has the potential to occur when pasting malicious HTML content from the clipboard that includes a data-method, data-remote or data-disable-with attribute."
}
],
"providerMetadata": {
"dateUpdated": "2025-01-09T00:33:47.769Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1033263"
},
{
"url": "https://discuss.rubyonrails.org/t/cve-2023-23913-dom-based-cross-site-scripting-in-rails-ujs-for-contenteditable-html-elements/82468"
},
{
"url": "https://github.com/rails/rails/commit/5037a13614d71727af8a175063bcf6ba1a74bdbd"
},
{
"url": "https://security.netapp.com/advisory/ntap-20240605-0007/"
},
{
"url": "https://www.debian.org/security/2023/dsa-5389"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2023-23913",
"datePublished": "2025-01-09T00:33:47.769Z",
"dateReserved": "2023-01-19T18:13:13.209Z",
"dateUpdated": "2025-01-09T17:09:39.091Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2026-33658 (GCVE-0-2026-33658)
Vulnerability from cvelistv5 – Published: 2026-03-26 21:03 – Updated: 2026-03-30 11:42
VLAI
EPSS
VEX
Title
Rails Active Storage has a possible DoS vulnerability in proxy mode via multi-range requests
Summary
Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1
Active Storage's proxy controller does not limit the number of byte ranges in an HTTP Range header. A request with thousands of small ranges causes disproportionate CPU usage compared to a normal request for the same file, possibly resulting in a DoS vulnerability. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/rails/rails/security/advisorie… | x_refsource_CONFIRM |
| https://github.com/rails/rails/releases/tag/v7.2.3.1 | x_refsource_MISC |
| https://github.com/rails/rails/releases/tag/v8.0.4.1 | x_refsource_MISC |
| https://github.com/rails/rails/releases/tag/v8.1.2.1 | x_refsource_MISC |
| https://github.com/rubysec/ruby-advisory-db/blob/… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| rails | activestorage |
Affected:
>= 8.1.0, < 8.1.2.1
Affected: >= 8.0.0, < 8.0.4.1 Affected: < 7.2.3.1 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-33658",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-30T11:42:16.532847Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-30T11:42:24.885Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "activestorage",
"vendor": "rails",
"versions": [
{
"status": "affected",
"version": "\u003e= 8.1.0, \u003c 8.1.2.1"
},
{
"status": "affected",
"version": "\u003e= 8.0.0, \u003c 8.0.4.1"
},
{
"status": "affected",
"version": "\u003c 7.2.3.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1\nActive Storage\u0027s proxy controller does not limit the number of byte ranges in an HTTP Range header. A request with thousands of small ranges causes disproportionate CPU usage compared to a normal request for the same file, possibly resulting in a DoS vulnerability. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.3,
"baseSeverity": "LOW",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770: Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-26T21:03:25.319Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/rails/rails/security/advisories/GHSA-p9fm-f462-ggrg",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/rails/rails/security/advisories/GHSA-p9fm-f462-ggrg"
},
{
"name": "https://github.com/rails/rails/releases/tag/v7.2.3.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/releases/tag/v7.2.3.1"
},
{
"name": "https://github.com/rails/rails/releases/tag/v8.0.4.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/releases/tag/v8.0.4.1"
},
{
"name": "https://github.com/rails/rails/releases/tag/v8.1.2.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/releases/tag/v8.1.2.1"
},
{
"name": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activestorage/CVE-2026-33658.yml",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activestorage/CVE-2026-33658.yml"
}
],
"source": {
"advisory": "GHSA-p9fm-f462-ggrg",
"discovery": "UNKNOWN"
},
"title": "Rails Active Storage has a possible DoS vulnerability in proxy mode via multi-range requests"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-33658",
"datePublished": "2026-03-26T21:03:25.319Z",
"dateReserved": "2026-03-23T15:23:42.219Z",
"dateUpdated": "2026-03-30T11:42:24.885Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-33202 (GCVE-0-2026-33202)
Vulnerability from cvelistv5 – Published: 2026-03-23 23:34 – Updated: 2026-03-24 15:44
VLAI
EPSS
VEX
Title
Rails Active Storage has possible glob injection in its DiskService
Summary
Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Storage's `DiskService#delete_prefixed` passes blob keys directly to `Dir.glob` without escaping glob metacharacters. If a blob key contains attacker-controlled input or custom-generated keys with glob metacharacters, it may be possible to delete unintended files from the storage directory. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/rails/rails/security/advisorie… | x_refsource_CONFIRM |
| https://github.com/rails/rails/commit/8c9676b8038… | x_refsource_MISC |
| https://github.com/rails/rails/commit/955284d26e4… | x_refsource_MISC |
| https://github.com/rails/rails/commit/fa190735463… | x_refsource_MISC |
| https://github.com/rails/rails/releases/tag/v7.2.3.1 | x_refsource_MISC |
| https://github.com/rails/rails/releases/tag/v8.0.4.1 | x_refsource_MISC |
| https://github.com/rails/rails/releases/tag/v8.1.2.1 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| rails | activestorage |
Affected:
>= 8.1.0.beta1, < 8.1.2.1
Affected: >= 8.0.0.beta1, < 8.0.4.1 Affected: < 7.2.3.1 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-33202",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-24T15:42:33.496549Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-24T15:44:19.018Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "activestorage",
"vendor": "rails",
"versions": [
{
"status": "affected",
"version": "\u003e= 8.1.0.beta1, \u003c 8.1.2.1"
},
{
"status": "affected",
"version": "\u003e= 8.0.0.beta1, \u003c 8.0.4.1"
},
{
"status": "affected",
"version": "\u003c 7.2.3.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Storage\u0027s `DiskService#delete_prefixed` passes blob keys directly to `Dir.glob` without escaping glob metacharacters. If a blob key contains attacker-controlled input or custom-generated keys with glob metacharacters, it may be possible to delete unintended files from the storage directory. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-23T23:34:52.715Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/rails/rails/security/advisories/GHSA-73f9-jhhh-hr5m",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/rails/rails/security/advisories/GHSA-73f9-jhhh-hr5m"
},
{
"name": "https://github.com/rails/rails/commit/8c9676b803820110548cdb7523800db43bc6874c",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/commit/8c9676b803820110548cdb7523800db43bc6874c"
},
{
"name": "https://github.com/rails/rails/commit/955284d26e469a9c026a4eee5b21f0414ab0bccf",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/commit/955284d26e469a9c026a4eee5b21f0414ab0bccf"
},
{
"name": "https://github.com/rails/rails/commit/fa19073546360856e9f4dab221fc2c5d73a45e82",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/commit/fa19073546360856e9f4dab221fc2c5d73a45e82"
},
{
"name": "https://github.com/rails/rails/releases/tag/v7.2.3.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/releases/tag/v7.2.3.1"
},
{
"name": "https://github.com/rails/rails/releases/tag/v8.0.4.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/releases/tag/v8.0.4.1"
},
{
"name": "https://github.com/rails/rails/releases/tag/v8.1.2.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/releases/tag/v8.1.2.1"
}
],
"source": {
"advisory": "GHSA-73f9-jhhh-hr5m",
"discovery": "UNKNOWN"
},
"title": "Rails Active Storage has possible glob injection in its DiskService"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-33202",
"datePublished": "2026-03-23T23:34:52.715Z",
"dateReserved": "2026-03-17T23:23:58.312Z",
"dateUpdated": "2026-03-24T15:44:19.018Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-33195 (GCVE-0-2026-33195)
Vulnerability from cvelistv5 – Published: 2026-03-23 23:31 – Updated: 2026-06-30 12:07
VLAI
EPSS
VEX
Title
Rails Active Storage has possible Path Traversal in DiskService
Summary
Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Storage's `DiskService#path_for` does not validate that the resolved filesystem path remains within the storage root directory. If a blob key containing path traversal sequences (e.g. `../`) is used, it could allow reading, writing, or deleting arbitrary files on the server. Blob keys are expected to be trusted strings, but some applications could be passing user input as keys and would be affected. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
10 references
| URL | Tags |
|---|---|
| https://github.com/rails/rails/security/advisorie… | x_refsource_CONFIRM |
| https://github.com/rails/rails/commit/4933c1e3b8c… | x_refsource_MISC |
| https://github.com/rails/rails/commit/9b06fbc0f50… | x_refsource_MISC |
| https://github.com/rails/rails/commit/a290c8a1ec1… | x_refsource_MISC |
| https://github.com/rails/rails/releases/tag/v7.2.3.1 | x_refsource_MISC |
| https://github.com/rails/rails/releases/tag/v8.0.4.1 | x_refsource_MISC |
| https://github.com/rails/rails/releases/tag/v8.1.2.1 | x_refsource_MISC |
| https://access.redhat.com/security/cve/CVE-2026-33195 | vdb-entryx_refsource_REDHAT |
| https://bugzilla.redhat.com/show_bug.cgi?id=2450546 | issue-trackingx_refsource_REDHAT |
| https://security.access.redhat.com/data/csaf/v2/v… | x_sadp-csaf-vex |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| rails | activestorage |
Affected:
>= 8.1.0.beta1, < 8.1.2.1
Affected: >= 8.0.0.beta1, < 8.0.4.1 Affected: < 7.2.3.1 |
|
| Red Hat | Red Hat 3scale API Management Platform 2 |
cpe:/a:redhat:red_hat_3scale_amp:2 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-33195",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-24T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T03:56:06.239Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"affected": [
{
"cpes": [
"cpe:/a:redhat:red_hat_3scale_amp:2"
],
"defaultStatus": "affected",
"product": "Red Hat 3scale API Management Platform 2",
"vendor": "Red Hat"
}
],
"datePublic": "2026-03-23T23:31:41.785Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in Active Storage, a component of Rails applications that manages file attachments. This vulnerability allows an attacker to manipulate file paths by using specially crafted input in blob keys. This manipulation can lead to unauthorized reading, writing, or deletion of arbitrary files on the server, potentially compromising the integrity and confidentiality of data."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-30T12:07:37.905Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-33195"
},
{
"name": "RHBZ#2450546",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450546"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33195.json"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-03-24T00:01:50.330Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-03-23T23:31:41.785Z",
"value": "Made public."
}
],
"title": "Rails: Active Storage: Active Storage (Rails): Arbitrary file access via path traversal in blob keys",
"workarounds": [
{
"lang": "en",
"value": "To mitigate this issue, ensure that blob keys used by Active Storage are not derived from untrusted user input. Applications should validate and sanitize any user-provided data before it is used in blob keys to prevent path traversal sequences."
}
],
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
}
],
"cna": {
"affected": [
{
"product": "activestorage",
"vendor": "rails",
"versions": [
{
"status": "affected",
"version": "\u003e= 8.1.0.beta1, \u003c 8.1.2.1"
},
{
"status": "affected",
"version": "\u003e= 8.0.0.beta1, \u003c 8.0.4.1"
},
{
"status": "affected",
"version": "\u003c 7.2.3.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Storage\u0027s `DiskService#path_for` does not validate that the resolved filesystem path remains within the storage root directory. If a blob key containing path traversal sequences (e.g. `../`) is used, it could allow reading, writing, or deleting arbitrary files on the server. Blob keys are expected to be trusted strings, but some applications could be passing user input as keys and would be affected. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-23T23:31:41.785Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/rails/rails/security/advisories/GHSA-9xrj-h377-fr87",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/rails/rails/security/advisories/GHSA-9xrj-h377-fr87"
},
{
"name": "https://github.com/rails/rails/commit/4933c1e3b8c1bb04925d60347be9f69270392f2c",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/commit/4933c1e3b8c1bb04925d60347be9f69270392f2c"
},
{
"name": "https://github.com/rails/rails/commit/9b06fbc0f504b8afe333f33d19548f3b85fbe655",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/commit/9b06fbc0f504b8afe333f33d19548f3b85fbe655"
},
{
"name": "https://github.com/rails/rails/commit/a290c8a1ec189d793aa6d7f2570b6a763f675348",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/commit/a290c8a1ec189d793aa6d7f2570b6a763f675348"
},
{
"name": "https://github.com/rails/rails/releases/tag/v7.2.3.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/releases/tag/v7.2.3.1"
},
{
"name": "https://github.com/rails/rails/releases/tag/v8.0.4.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/releases/tag/v8.0.4.1"
},
{
"name": "https://github.com/rails/rails/releases/tag/v8.1.2.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/releases/tag/v8.1.2.1"
}
],
"source": {
"advisory": "GHSA-9xrj-h377-fr87",
"discovery": "UNKNOWN"
},
"title": "Rails Active Storage has possible Path Traversal in DiskService"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-33195",
"datePublished": "2026-03-23T23:31:41.785Z",
"dateReserved": "2026-03-17T22:16:36.721Z",
"dateUpdated": "2026-06-30T12:07:37.905Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-33176 (GCVE-0-2026-33176)
Vulnerability from cvelistv5 – Published: 2026-03-23 23:29 – Updated: 2026-03-24 18:42
VLAI
EPSS
VEX
Title
Rails Active Support has a possible DoS vulnerability in its number helpers
Summary
Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Support number helpers accept strings containing scientific notation (e.g. `1e10000`), which `BigDecimal` expands into extremely large decimal representations. This can cause excessive memory allocation and CPU consumption when the expanded number is formatted, possibly resulting in a DoS vulnerability. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/rails/rails/security/advisorie… | x_refsource_CONFIRM |
| https://github.com/rails/rails/commit/19dbab51ca0… | x_refsource_MISC |
| https://github.com/rails/rails/commit/ebd6be18120… | x_refsource_MISC |
| https://github.com/rails/rails/commit/ee2c59e730e… | x_refsource_MISC |
| https://github.com/rails/rails/releases/tag/v7.2.3.1 | x_refsource_MISC |
| https://github.com/rails/rails/releases/tag/v8.0.4.1 | x_refsource_MISC |
| https://github.com/rails/rails/releases/tag/v8.1.2.1 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| rails | activesupport |
Affected:
>= 8.1.0.beta1, < 8.1.2.1
Affected: >= 8.0.0.beta1, < 8.0.4.1 Affected: < 7.2.3.1 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-33176",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-24T18:42:42.653404Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-24T18:42:48.858Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "activesupport",
"vendor": "rails",
"versions": [
{
"status": "affected",
"version": "\u003e= 8.1.0.beta1, \u003c 8.1.2.1"
},
{
"status": "affected",
"version": "\u003e= 8.0.0.beta1, \u003c 8.0.4.1"
},
{
"status": "affected",
"version": "\u003c 7.2.3.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Support number helpers accept strings containing scientific notation (e.g. `1e10000`), which `BigDecimal` expands into extremely large decimal representations. This can cause excessive memory allocation and CPU consumption when the expanded number is formatted, possibly resulting in a DoS vulnerability. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400: Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770: Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-23T23:29:27.933Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/rails/rails/security/advisories/GHSA-2j26-frm8-cmj9",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/rails/rails/security/advisories/GHSA-2j26-frm8-cmj9"
},
{
"name": "https://github.com/rails/rails/commit/19dbab51ca086a657bb86458042bc44314916bcb",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/commit/19dbab51ca086a657bb86458042bc44314916bcb"
},
{
"name": "https://github.com/rails/rails/commit/ebd6be18120d1136511eb516338e27af25ac0a1a",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/commit/ebd6be18120d1136511eb516338e27af25ac0a1a"
},
{
"name": "https://github.com/rails/rails/commit/ee2c59e730e5b8faed502cd2c573109df093f856",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/commit/ee2c59e730e5b8faed502cd2c573109df093f856"
},
{
"name": "https://github.com/rails/rails/releases/tag/v7.2.3.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/releases/tag/v7.2.3.1"
},
{
"name": "https://github.com/rails/rails/releases/tag/v8.0.4.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/releases/tag/v8.0.4.1"
},
{
"name": "https://github.com/rails/rails/releases/tag/v8.1.2.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/releases/tag/v8.1.2.1"
}
],
"source": {
"advisory": "GHSA-2j26-frm8-cmj9",
"discovery": "UNKNOWN"
},
"title": "Rails Active Support has a possible DoS vulnerability in its number helpers"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-33176",
"datePublished": "2026-03-23T23:29:27.933Z",
"dateReserved": "2026-03-17T22:16:36.719Z",
"dateUpdated": "2026-03-24T18:42:48.858Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-33174 (GCVE-0-2026-33174)
Vulnerability from cvelistv5 – Published: 2026-03-23 23:24 – Updated: 2026-03-24 13:40
VLAI
EPSS
VEX
Title
Rails Active Storage has a possible DoS vulnerability when in proxy mode via Range requests
Summary
Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, when serving files through Active Storage's proxy delivery mode, the proxy controller loads the entire requested byte range into memory before sending it. A request with a large or unbounded Range header (e.g. `bytes=0-`) could cause the server to allocate memory proportional to the file size, possibly resulting in a DoS vulnerability through memory exhaustion. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-789 - Memory Allocation with Excessive Size Value
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/rails/rails/security/advisorie… | x_refsource_CONFIRM |
| https://github.com/rails/rails/commit/2cd933c366b… | x_refsource_MISC |
| https://github.com/rails/rails/commit/42012eaaa88… | x_refsource_MISC |
| https://github.com/rails/rails/commit/8159a9c3de3… | x_refsource_MISC |
| https://github.com/rails/rails/releases/tag/v7.2.3.1 | x_refsource_MISC |
| https://github.com/rails/rails/releases/tag/v8.0.4.1 | x_refsource_MISC |
| https://github.com/rails/rails/releases/tag/v8.1.2.1 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| rails | activestorage |
Affected:
>= 8.1.0.beta1, < 8.1.2.1
Affected: >= 8.0.0.beta1, < 8.0.4.1 Affected: < 7.2.3.1 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-33174",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-24T13:40:23.185319Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-24T13:40:32.031Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "activestorage",
"vendor": "rails",
"versions": [
{
"status": "affected",
"version": "\u003e= 8.1.0.beta1, \u003c 8.1.2.1"
},
{
"status": "affected",
"version": "\u003e= 8.0.0.beta1, \u003c 8.0.4.1"
},
{
"status": "affected",
"version": "\u003c 7.2.3.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, when serving files through Active Storage\u0027s proxy delivery mode, the proxy controller loads the entire requested byte range into memory before sending it. A request with a large or unbounded Range header (e.g. `bytes=0-`) could cause the server to allocate memory proportional to the file size, possibly resulting in a DoS vulnerability through memory exhaustion. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-789",
"description": "CWE-789: Memory Allocation with Excessive Size Value",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-23T23:25:23.363Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/rails/rails/security/advisories/GHSA-r46p-8f7g-vvvg",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/rails/rails/security/advisories/GHSA-r46p-8f7g-vvvg"
},
{
"name": "https://github.com/rails/rails/commit/2cd933c366b777f873d4d590127da2f4a25e4ba5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/commit/2cd933c366b777f873d4d590127da2f4a25e4ba5"
},
{
"name": "https://github.com/rails/rails/commit/42012eaaa88dfc7d0030161b2bc8074a7bbce92a",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/commit/42012eaaa88dfc7d0030161b2bc8074a7bbce92a"
},
{
"name": "https://github.com/rails/rails/commit/8159a9c3de3f27a2bcf2866b8bf9ceb9075e229b",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/commit/8159a9c3de3f27a2bcf2866b8bf9ceb9075e229b"
},
{
"name": "https://github.com/rails/rails/releases/tag/v7.2.3.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/releases/tag/v7.2.3.1"
},
{
"name": "https://github.com/rails/rails/releases/tag/v8.0.4.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/releases/tag/v8.0.4.1"
},
{
"name": "https://github.com/rails/rails/releases/tag/v8.1.2.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/releases/tag/v8.1.2.1"
}
],
"source": {
"advisory": "GHSA-r46p-8f7g-vvvg",
"discovery": "UNKNOWN"
},
"title": "Rails Active Storage has a possible DoS vulnerability when in proxy mode via Range requests"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-33174",
"datePublished": "2026-03-23T23:24:55.594Z",
"dateReserved": "2026-03-17T22:16:36.719Z",
"dateUpdated": "2026-03-24T13:40:32.031Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-33173 (GCVE-0-2026-33173)
Vulnerability from cvelistv5 – Published: 2026-03-23 23:21 – Updated: 2026-03-24 15:12
VLAI
EPSS
VEX
Title
Rails Active Storage has possible content type bypass via metadata in direct uploads
Summary
Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, `DirectUploadsController` accepts arbitrary metadata from the client and persists it on the blob. Because internal flags like `identified` and `analyzed` are stored in the same metadata hash, a direct-upload client can set these flags to skip MIME detection and analysis. This allows an attacker to upload arbitrary content while claiming a safe `content_type`, bypassing any validations that rely on Active Storage's automatic content type identification. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-925 - Improper Verification of Intent by Broadcast Receiver
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/rails/rails/security/advisorie… | x_refsource_CONFIRM |
| https://github.com/rails/rails/commit/707c0f1f41f… | x_refsource_MISC |
| https://github.com/rails/rails/commit/8fcb934caad… | x_refsource_MISC |
| https://github.com/rails/rails/commit/d9502f5214e… | x_refsource_MISC |
| https://github.com/rails/rails/releases/tag/v7.2.3.1 | x_refsource_MISC |
| https://github.com/rails/rails/releases/tag/v8.0.4.1 | x_refsource_MISC |
| https://github.com/rails/rails/releases/tag/v8.1.2.1 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| rails | activestorage |
Affected:
>= 8.1.0.beta1, < 8.1.2.1
Affected: >= 8.0.0.beta1, < 8.0.4.1 Affected: < 7.2.3.1 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-33173",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-24T14:14:22.499615Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-24T15:12:50.569Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "activestorage",
"vendor": "rails",
"versions": [
{
"status": "affected",
"version": "\u003e= 8.1.0.beta1, \u003c 8.1.2.1"
},
{
"status": "affected",
"version": "\u003e= 8.0.0.beta1, \u003c 8.0.4.1"
},
{
"status": "affected",
"version": "\u003c 7.2.3.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, `DirectUploadsController` accepts arbitrary metadata from the client and persists it on the blob. Because internal flags like `identified` and `analyzed` are stored in the same metadata hash, a direct-upload client can set these flags to skip MIME detection and analysis. This allows an attacker to upload arbitrary content while claiming a safe `content_type`, bypassing any validations that rely on Active Storage\u0027s automatic content type identification. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-925",
"description": "CWE-925: Improper Verification of Intent by Broadcast Receiver",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-23T23:21:29.843Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/rails/rails/security/advisories/GHSA-qcfx-2mfw-w4cg",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/rails/rails/security/advisories/GHSA-qcfx-2mfw-w4cg"
},
{
"name": "https://github.com/rails/rails/commit/707c0f1f41f067fdf96d54e99d43b28dfaae7e53",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/commit/707c0f1f41f067fdf96d54e99d43b28dfaae7e53"
},
{
"name": "https://github.com/rails/rails/commit/8fcb934caadc79c8cc4ce53287046d0f67005b3e",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/commit/8fcb934caadc79c8cc4ce53287046d0f67005b3e"
},
{
"name": "https://github.com/rails/rails/commit/d9502f5214e2198245a4c1defe9cd02a7c8057d0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/commit/d9502f5214e2198245a4c1defe9cd02a7c8057d0"
},
{
"name": "https://github.com/rails/rails/releases/tag/v7.2.3.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/releases/tag/v7.2.3.1"
},
{
"name": "https://github.com/rails/rails/releases/tag/v8.0.4.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/releases/tag/v8.0.4.1"
},
{
"name": "https://github.com/rails/rails/releases/tag/v8.1.2.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/releases/tag/v8.1.2.1"
}
],
"source": {
"advisory": "GHSA-qcfx-2mfw-w4cg",
"discovery": "UNKNOWN"
},
"title": "Rails Active Storage has possible content type bypass via metadata in direct uploads"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-33173",
"datePublished": "2026-03-23T23:21:29.843Z",
"dateReserved": "2026-03-17T22:16:36.719Z",
"dateUpdated": "2026-03-24T15:12:50.569Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-33170 (GCVE-0-2026-33170)
Vulnerability from cvelistv5 – Published: 2026-03-23 23:09 – Updated: 2026-03-25 19:20
VLAI
EPSS
VEX
Title
Rails Active Support has a possible XSS vulnerability in SafeBuffer#%
Summary
Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, `SafeBuffer#%` does not propagate the `@html_unsafe` flag to the newly created buffer. If a `SafeBuffer` is mutated in place (e.g. via `gsub!`) and then formatted with `%` using untrusted arguments, the result incorrectly reports `html_safe? == true`, bypassing ERB auto-escaping and possibly leading to XSS. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/rails/rails/security/advisorie… | x_refsource_CONFIRM |
| https://github.com/rails/rails/commit/50d732af3b7… | x_refsource_MISC |
| https://github.com/rails/rails/commit/6e8a8110800… | x_refsource_MISC |
| https://github.com/rails/rails/commit/c1ad0e8e197… | x_refsource_MISC |
| https://github.com/rails/rails/releases/tag/v7.2.3.1 | x_refsource_MISC |
| https://github.com/rails/rails/releases/tag/v8.0.4.1 | x_refsource_MISC |
| https://github.com/rails/rails/releases/tag/v8.1.2.1 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| rails | activesupport |
Affected:
>= 8.1.0.beta1, < 8.1.2.1
Affected: >= 8.0.0.beta1, < 8.0.4.1 Affected: < 7.2.3.1 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-33170",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-25T19:20:16.086015Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T19:20:28.280Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "activesupport",
"vendor": "rails",
"versions": [
{
"status": "affected",
"version": "\u003e= 8.1.0.beta1, \u003c 8.1.2.1"
},
{
"status": "affected",
"version": "\u003e= 8.0.0.beta1, \u003c 8.0.4.1"
},
{
"status": "affected",
"version": "\u003c 7.2.3.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, `SafeBuffer#%` does not propagate the `@html_unsafe` flag to the newly created buffer. If a `SafeBuffer` is mutated in place (e.g. via `gsub!`) and then formatted with `%` using untrusted arguments, the result incorrectly reports `html_safe? == true`, bypassing ERB auto-escaping and possibly leading to XSS. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-23T23:19:36.467Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/rails/rails/security/advisories/GHSA-89vf-4333-qx8v",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/rails/rails/security/advisories/GHSA-89vf-4333-qx8v"
},
{
"name": "https://github.com/rails/rails/commit/50d732af3b7c8aaf63cbcca0becbc00279b215b7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/commit/50d732af3b7c8aaf63cbcca0becbc00279b215b7"
},
{
"name": "https://github.com/rails/rails/commit/6e8a81108001d58043de9e54a06fca58962fc2db",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/commit/6e8a81108001d58043de9e54a06fca58962fc2db"
},
{
"name": "https://github.com/rails/rails/commit/c1ad0e8e1972032f3395853a5e99cea035035beb",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/commit/c1ad0e8e1972032f3395853a5e99cea035035beb"
},
{
"name": "https://github.com/rails/rails/releases/tag/v7.2.3.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/releases/tag/v7.2.3.1"
},
{
"name": "https://github.com/rails/rails/releases/tag/v8.0.4.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/releases/tag/v8.0.4.1"
},
{
"name": "https://github.com/rails/rails/releases/tag/v8.1.2.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/releases/tag/v8.1.2.1"
}
],
"source": {
"advisory": "GHSA-89vf-4333-qx8v",
"discovery": "UNKNOWN"
},
"title": "Rails Active Support has a possible XSS vulnerability in SafeBuffer#%"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-33170",
"datePublished": "2026-03-23T23:09:48.923Z",
"dateReserved": "2026-03-17T21:17:08.888Z",
"dateUpdated": "2026-03-25T19:20:28.280Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-33169 (GCVE-0-2026-33169)
Vulnerability from cvelistv5 – Published: 2026-03-23 23:07 – Updated: 2026-03-24 15:46
VLAI
EPSS
VEX
Title
Rails Active Support has a possible ReDoS vulnerability in number_to_delimited
Summary
Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. `NumberToDelimitedConverter` uses a lookahead-based regular expression with `gsub!` to insert thousands delimiters. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, the interaction between the repeated lookahead group and `gsub!` can produce quadratic time complexity on long digit strings. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/rails/rails/security/advisorie… | x_refsource_CONFIRM |
| https://github.com/rails/rails/commit/29154f1097d… | x_refsource_MISC |
| https://github.com/rails/rails/commit/b54a4b373c6… | x_refsource_MISC |
| https://github.com/rails/rails/commit/ec1a0e215ef… | x_refsource_MISC |
| https://github.com/rails/rails/releases/tag/v7.2.3.1 | x_refsource_MISC |
| https://github.com/rails/rails/releases/tag/v8.0.4.1 | x_refsource_MISC |
| https://github.com/rails/rails/releases/tag/v8.1.2.1 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| rails | activesupport |
Affected:
>= 8.1.0.beta1, < 8.1.2.1
Affected: >= 8.0.0.beta1, < 8.0.4.1 Affected: < 7.2.3.1 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-33169",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-24T15:45:49.354964Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-24T15:46:43.465Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "activesupport",
"vendor": "rails",
"versions": [
{
"status": "affected",
"version": "\u003e= 8.1.0.beta1, \u003c 8.1.2.1"
},
{
"status": "affected",
"version": "\u003e= 8.0.0.beta1, \u003c 8.0.4.1"
},
{
"status": "affected",
"version": "\u003c 7.2.3.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. `NumberToDelimitedConverter` uses a lookahead-based regular expression with `gsub!` to insert thousands delimiters. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, the interaction between the repeated lookahead group and `gsub!` can produce quadratic time complexity on long digit strings. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400: Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-1333",
"description": "CWE-1333: Inefficient Regular Expression Complexity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-23T23:19:24.387Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/rails/rails/security/advisories/GHSA-cg4j-q9v8-6v38",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/rails/rails/security/advisories/GHSA-cg4j-q9v8-6v38"
},
{
"name": "https://github.com/rails/rails/commit/29154f1097da13d48fdb3200760b3e3da66dcb11",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/commit/29154f1097da13d48fdb3200760b3e3da66dcb11"
},
{
"name": "https://github.com/rails/rails/commit/b54a4b373c6f042cab6ee2033246b1c9ecc38974",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/commit/b54a4b373c6f042cab6ee2033246b1c9ecc38974"
},
{
"name": "https://github.com/rails/rails/commit/ec1a0e215efd27a3b3911aae6df978a80f456a49",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/commit/ec1a0e215efd27a3b3911aae6df978a80f456a49"
},
{
"name": "https://github.com/rails/rails/releases/tag/v7.2.3.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/releases/tag/v7.2.3.1"
},
{
"name": "https://github.com/rails/rails/releases/tag/v8.0.4.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/releases/tag/v8.0.4.1"
},
{
"name": "https://github.com/rails/rails/releases/tag/v8.1.2.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/releases/tag/v8.1.2.1"
}
],
"source": {
"advisory": "GHSA-cg4j-q9v8-6v38",
"discovery": "UNKNOWN"
},
"title": "Rails Active Support has a possible ReDoS vulnerability in number_to_delimited"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-33169",
"datePublished": "2026-03-23T23:07:07.630Z",
"dateReserved": "2026-03-17T21:17:08.888Z",
"dateUpdated": "2026-03-24T15:46:43.465Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-33168 (GCVE-0-2026-33168)
Vulnerability from cvelistv5 – Published: 2026-03-23 23:01 – Updated: 2026-03-24 13:36
VLAI
EPSS
VEX
Title
Rails has a possible XSS vulnerability in its Action View tag helpers
Summary
Action View provides conventions and helpers for building web pages with the Rails framework. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, when a blank string is used as an HTML attribute name in Action View tag helpers, the attribute escaping is bypassed, producing malformed HTML. A carefully crafted attribute value could then be misinterpreted by the browser as a separate attribute name, possibly leading to XSS. Applications that allow users to specify custom HTML attributes are affected. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/rails/rails/security/advisorie… | x_refsource_CONFIRM |
| https://github.com/rails/rails/commit/0b6f8002b52… | x_refsource_MISC |
| https://github.com/rails/rails/commit/63f5ad83eda… | x_refsource_MISC |
| https://github.com/rails/rails/commit/c79a07df1e8… | x_refsource_MISC |
| https://github.com/rails/rails/releases/tag/v7.2.3.1 | x_refsource_MISC |
| https://github.com/rails/rails/releases/tag/v8.0.4.1 | x_refsource_MISC |
| https://github.com/rails/rails/releases/tag/v8.1.2.1 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| rails | actionview |
Affected:
>= 8.1.0.beta1, < 8.1.2.1
Affected: >= 8.0.0.beta1, < 8.0.4.1 Affected: < 7.2.3.1 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-33168",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-24T13:36:28.555604Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-24T13:36:44.829Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "actionview",
"vendor": "rails",
"versions": [
{
"status": "affected",
"version": "\u003e= 8.1.0.beta1, \u003c 8.1.2.1"
},
{
"status": "affected",
"version": "\u003e= 8.0.0.beta1, \u003c 8.0.4.1"
},
{
"status": "affected",
"version": "\u003c 7.2.3.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Action View provides conventions and helpers for building web pages with the Rails framework. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, when a blank string is used as an HTML attribute name in Action View tag helpers, the attribute escaping is bypassed, producing malformed HTML. A carefully crafted attribute value could then be misinterpreted by the browser as a separate attribute name, possibly leading to XSS. Applications that allow users to specify custom HTML attributes are affected. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.3,
"baseSeverity": "LOW",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-23T23:19:11.173Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/rails/rails/security/advisories/GHSA-v55j-83pf-r9cq",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/rails/rails/security/advisories/GHSA-v55j-83pf-r9cq"
},
{
"name": "https://github.com/rails/rails/commit/0b6f8002b52b9c606fd6be9e7915d9f944cf539c",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/commit/0b6f8002b52b9c606fd6be9e7915d9f944cf539c"
},
{
"name": "https://github.com/rails/rails/commit/63f5ad83edaa0b976f82d46988d745426aa4a42d",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/commit/63f5ad83edaa0b976f82d46988d745426aa4a42d"
},
{
"name": "https://github.com/rails/rails/commit/c79a07df1e88738df8f68cb0ee759ad6128ca924",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/commit/c79a07df1e88738df8f68cb0ee759ad6128ca924"
},
{
"name": "https://github.com/rails/rails/releases/tag/v7.2.3.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/releases/tag/v7.2.3.1"
},
{
"name": "https://github.com/rails/rails/releases/tag/v8.0.4.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/releases/tag/v8.0.4.1"
},
{
"name": "https://github.com/rails/rails/releases/tag/v8.1.2.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/releases/tag/v8.1.2.1"
}
],
"source": {
"advisory": "GHSA-v55j-83pf-r9cq",
"discovery": "UNKNOWN"
},
"title": "Rails has a possible XSS vulnerability in its Action View tag helpers"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-33168",
"datePublished": "2026-03-23T23:01:22.019Z",
"dateReserved": "2026-03-17T21:17:08.888Z",
"dateUpdated": "2026-03-24T13:36:44.829Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-33167 (GCVE-0-2026-33167)
Vulnerability from cvelistv5 – Published: 2026-03-23 22:58 – Updated: 2026-03-24 18:44
VLAI
EPSS
VEX
Title
Rails has a possible XSS vulnerability in its Action Pack debug exceptions
Summary
Action Pack is a Rubygem for building web applications on the Rails framework. In versions on the 8.1 branch prior to 8.1.2.1, the debug exceptions page does not properly escape exception messages. A carefully crafted exception message could inject arbitrary HTML and JavaScript into the page, leading to XSS. This affects applications with detailed exception pages enabled (`config.consider_all_requests_local = true`), which is the default in development. Version 8.1.2.1 contains a patch.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/rails/rails/security/advisorie… | x_refsource_CONFIRM |
| https://github.com/rails/rails/commit/6752711c8c3… | x_refsource_MISC |
| https://github.com/rails/rails/releases/tag/v8.1.2.1 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| rails | actionpack |
Affected:
>= 8.1.0, < 8.1.2.1
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-33167",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-24T18:44:05.658370Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-24T18:44:13.020Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "actionpack",
"vendor": "rails",
"versions": [
{
"status": "affected",
"version": "\u003e= 8.1.0, \u003c 8.1.2.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Action Pack is a Rubygem for building web applications on the Rails framework. In versions on the 8.1 branch prior to 8.1.2.1, the debug exceptions page does not properly escape exception messages. A carefully crafted exception message could inject arbitrary HTML and JavaScript into the page, leading to XSS. This affects applications with detailed exception pages enabled (`config.consider_all_requests_local = true`), which is the default in development. Version 8.1.2.1 contains a patch."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 1.3,
"baseSeverity": "LOW",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-23T23:18:56.415Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/rails/rails/security/advisories/GHSA-pgm4-439c-5jp6",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/rails/rails/security/advisories/GHSA-pgm4-439c-5jp6"
},
{
"name": "https://github.com/rails/rails/commit/6752711c8c31d79ba50d13af6a6698a3b85415e0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/commit/6752711c8c31d79ba50d13af6a6698a3b85415e0"
},
{
"name": "https://github.com/rails/rails/releases/tag/v8.1.2.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/releases/tag/v8.1.2.1"
}
],
"source": {
"advisory": "GHSA-pgm4-439c-5jp6",
"discovery": "UNKNOWN"
},
"title": "Rails has a possible XSS vulnerability in its Action Pack debug exceptions"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-33167",
"datePublished": "2026-03-23T22:58:53.577Z",
"dateReserved": "2026-03-17T21:17:08.888Z",
"dateUpdated": "2026-03-24T18:44:13.020Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-24293 (GCVE-0-2025-24293)
Vulnerability from cvelistv5 – Published: 2026-01-30 20:11 – Updated: 2026-06-30 12:07
VLAI
EPSS
VEX
Summary
# Active Storage allowed transformation methods potentially unsafe
Active Storage attempts to prevent the use of potentially unsafe image
transformation methods and parameters by default.
The default allowed list contains three methods allow for the circumvention
of the safe defaults which enables potential command injection
vulnerabilities in cases where arbitrary user supplied input is accepted as
valid transformation methods or parameters.
Impact
------
This vulnerability impacts applications that use Active Storage with the image_processing processing gem in addition to mini_magick as the image processor.
Vulnerable code will look something similar to this:
```
<%= image_tag blob.variant(params[:t] => params[:v]) %>
```
Where the transformation method or its arguments are untrusted arbitrary input.
All users running an affected release should either upgrade or use one of the workarounds immediately.
Workarounds
-----------
Consuming user supplied input for image transformation methods or their parameters is unsupported behavior and should be considered dangerous.
Strict validation of user supplied methods and parameters should be performed
as well as having a strong [ImageMagick security
policy](https://imagemagick.org/script/security-policy.php) deployed.
Credits
-------
Thank you [lio346](https://hackerone.com/lio346) for reporting this!
Severity
8.1 (High)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/advisories/GHSA-r4mg-4433-c7g3 | |
| https://access.redhat.com/security/cve/CVE-2025-24293 | vdb-entryx_refsource_REDHAT |
| https://bugzilla.redhat.com/show_bug.cgi?id=2435565 | issue-trackingx_refsource_REDHAT |
| https://security.access.redhat.com/data/csaf/v2/v… | x_sadp-csaf-vex |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Rails | activestorage |
Affected:
5.2 , < 5.*
(semver)
Affected: 7.0 , < 7.1.5.2 (semver) Affected: 8.0 , < 7.0.2.1 (semver) |
|
| Red Hat | Red Hat 3scale API Management Platform 2 |
cpe:/a:redhat:red_hat_3scale_amp:2 |
|
| Red Hat | Red Hat Satellite 6 |
cpe:/a:redhat:satellite:6 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-24293",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-02-02T14:45:32.482487Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "CWE-77 Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-02-02T14:47:12.620Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"affected": [
{
"cpes": [
"cpe:/a:redhat:red_hat_3scale_amp:2"
],
"defaultStatus": "unaffected",
"product": "Red Hat 3scale API Management Platform 2",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:satellite:6"
],
"defaultStatus": "unaffected",
"product": "Red Hat Satellite 6",
"vendor": "Red Hat"
}
],
"datePublic": "2026-01-30T20:11:15.219Z",
"descriptions": [
{
"lang": "en",
"value": "Active Storage attempts to prevent the use of potentially unsafe image transformation methods and parameters by default. The default allowed list contains three methods allowing for the circumvention of the safe defaults which enables potential command injection vulnerabilities in cases where arbitrary user supplied input is accepted as valid transformation methods or parameters. This vulnerability impacts applications that use Active Storage with the image_processing processing gem in addition to mini_magick as the image processor."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-88",
"description": "Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-30T12:07:21.225Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2025-24293"
},
{
"name": "RHBZ#2435565",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2435565"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-24293.json"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-01-30T21:01:14.441Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-01-30T20:11:15.219Z",
"value": "Made public."
}
],
"title": "activestorage: Code injection in Active Storage when used in conjunction with the image_processing gem",
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "activestorage",
"vendor": "Rails",
"versions": [
{
"lessThan": "5.*",
"status": "affected",
"version": "5.2",
"versionType": "semver"
},
{
"lessThan": "7.1.5.2",
"status": "affected",
"version": "7.0",
"versionType": "semver"
},
{
"lessThan": "7.0.2.1",
"status": "affected",
"version": "8.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "# Active Storage allowed transformation methods potentially unsafe\r\n\r\nActive Storage attempts to prevent the use of potentially unsafe image\r\ntransformation methods and parameters by default.\r\n\r\nThe default allowed list contains three methods allow for the circumvention\r\nof the safe defaults which enables potential command injection\r\nvulnerabilities in cases where arbitrary user supplied input is accepted as\r\nvalid transformation methods or parameters.\r\n\r\n\r\nImpact\r\n------\r\nThis vulnerability impacts applications that use Active Storage with the image_processing processing gem in addition to mini_magick as the image processor.\r\n\r\nVulnerable code will look something similar to this:\r\n```\r\n\u003c%= image_tag blob.variant(params[:t] =\u003e params[:v]) %\u003e\r\n```\r\n\r\nWhere the transformation method or its arguments are untrusted arbitrary input.\r\n\r\nAll users running an affected release should either upgrade or use one of the workarounds immediately.\r\n\r\n\r\n\r\nWorkarounds\r\n-----------\r\nConsuming user supplied input for image transformation methods or their parameters is unsupported behavior and should be considered dangerous.\r\n\r\nStrict validation of user supplied methods and parameters should be performed\r\nas well as having a strong [ImageMagick security\r\npolicy](https://imagemagick.org/script/security-policy.php) deployed.\r\n\r\nCredits\r\n-------\r\n\r\nThank you [lio346](https://hackerone.com/lio346) for reporting this!"
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 9.2,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-01-30T20:11:15.219Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://github.com/advisories/GHSA-r4mg-4433-c7g3"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2025-24293",
"datePublished": "2026-01-30T20:11:15.219Z",
"dateReserved": "2025-01-17T01:00:07.458Z",
"dateUpdated": "2026-06-30T12:07:21.225Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-55193 (GCVE-0-2025-55193)
Vulnerability from cvelistv5 – Published: 2025-08-13 22:41 – Updated: 2025-08-14 14:51
VLAI
EPSS
VEX
Title
Active Record logging vulnerable to ANSI escape injection
Summary
Active Record connects classes to relational database tables. Prior to versions 7.1.5.2, 7.2.2.2, and 8.0.2.1, the ID passed to find or similar methods may be logged without escaping. If this is directly to the terminal it may include unescaped ANSI sequences. This issue has been patched in versions 7.1.5.2, 7.2.2.2, and 8.0.2.1.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-150 - Improper Neutralization of Escape, Meta, or Control Sequences
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/rails/rails/security/advisorie… | x_refsource_CONFIRM |
| https://github.com/rails/rails/commit/3beef200137… | x_refsource_MISC |
| https://github.com/rails/rails/commit/568c0bc2f1e… | x_refsource_MISC |
| https://github.com/rails/rails/commit/6a944ca4805… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-55193",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-08-14T13:42:07.857418Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-08-14T14:51:11.284Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "rails",
"vendor": "rails",
"versions": [
{
"status": "affected",
"version": "\u003e= 0, \u003c 7.1.5.2"
},
{
"status": "affected",
"version": "\u003e= 7.2, \u003c 7.2.2.2"
},
{
"status": "affected",
"version": "\u003e= 8.0, \u003c 8.0.2.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Active Record connects classes to relational database tables. Prior to versions 7.1.5.2, 7.2.2.2, and 8.0.2.1, the ID passed to find or similar methods may be logged without escaping. If this is directly to the terminal it may include unescaped ANSI sequences. This issue has been patched in versions 7.1.5.2, 7.2.2.2, and 8.0.2.1."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 2.7,
"baseSeverity": "LOW",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:U",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-150",
"description": "CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-08-13T22:41:41.890Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/rails/rails/security/advisories/GHSA-76r7-hhxj-r776",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/rails/rails/security/advisories/GHSA-76r7-hhxj-r776"
},
{
"name": "https://github.com/rails/rails/commit/3beef20013736fd52c5dcfdf061f7999ba318290",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/commit/3beef20013736fd52c5dcfdf061f7999ba318290"
},
{
"name": "https://github.com/rails/rails/commit/568c0bc2f1e74c65d150a84b89a080949bf9eb9b",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/commit/568c0bc2f1e74c65d150a84b89a080949bf9eb9b"
},
{
"name": "https://github.com/rails/rails/commit/6a944ca4805e72050a0fbb1a461534eb760d3202",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/commit/6a944ca4805e72050a0fbb1a461534eb760d3202"
}
],
"source": {
"advisory": "GHSA-76r7-hhxj-r776",
"discovery": "UNKNOWN"
},
"title": "Active Record logging vulnerable to ANSI escape injection"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2025-55193",
"datePublished": "2025-08-13T22:41:41.890Z",
"dateReserved": "2025-08-08T21:55:07.963Z",
"dateUpdated": "2025-08-14T14:51:11.284Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}