Skip to content
OpenAdvisories
Critical DSA-6090-1 2 CVEs

rails - security update

Published Dec 21, 2025 · Updated Dec 21, 2025

Ecosystem: Debian

Fixed packages 2

ReleasePackageFixed in
Debian · 12 rails 2:6.1.7.10+dfsg-1~deb12u2
Debian · 13 rails 2:7.2.2.2+dfsg-2~deb13u1

Vulnerabilities 2

  • Critical 9.2
    CVE-2025-24293 Public exploit

    Active Storage allowed transformation methods that were potentially unsafe

    # Active Storage allowed transformation methods potentially unsafe Active Storage attempts to prevent the use of potentially unsafe image transformation methods and parameters by default. The default allowed list contains three methods allow for the circumven…

    rails activestorage rails rails Debian Ubuntu RubyGems
  • Low 2.7
    CVE-2025-55193

    Active Record logging vulnerable to ANSI escape injection

    Active Record connects classes to relational database tables. Prior to versions 7.1.5.2, 7.2.2.2, and 8.0.2.1, the ID passed to find or similar methods may be logged without escaping. If this is directly to the terminal it may include unescaped ANSI sequences…

    rails rails rails rails Debian Ubuntu Wolfi RubyGems