Skip to content
OpenAdvisories
High USN-7497-1 2 CVEs

ruby-carrierwave vulnerabilities

Published May 7, 2025 · Updated Apr 27, 2026

Ecosystem: Ubuntu

Summary

Rikita Ishikawa discovered that CarrierWave did not correctly sanitize
certain inputs. An attacker could possibly use this issue to execute
arbitrary code. This issue only affected Ubuntu 18.04 LTS and
Ubuntu 20.04 LTS. (CVE-2021-21305)

Norihide Saito discovered that CarrierWave did not correctly sanitize
certain inputs. An attacker could possibly use this issue to execute a
cross-site scripting (XSS) attack. (CVE-2023-49090)

Fixed packages 4

ReleasePackageFixed in
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS ruby-carrierwave 1.2.2-1ubuntu0.1~esm1
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS ruby-carrierwave 1.3.1-2ubuntu0.1~esm1
Ubuntu · Pro 22.04 LTS Pro:22.04:LTS ruby-carrierwave 1.3.2-2ubuntu0.22.04.1~esm1
Ubuntu · Pro 24.04 LTS Pro:24.04:LTS ruby-carrierwave 1.3.2-2ubuntu0.24.04.1~esm1

Vulnerabilities 2

  • High 7.4
    CVE-2021-21305 EPSS 13%

    Code Injection vulnerability in CarrierWave

    CarrierWave is an open-source RubyGem which provides a simple and flexible way to upload files from Ruby applications. In CarrierWave before versions 1.3.2 and 2.1.1, there is a code injection vulnerability. The "#manipulate!" method inappropriately evals the…

    carrierwaveuploader carrierwave carrierwave ruby-carrierwave Debian Ubuntu RubyGems
  • Medium 6.8
    CVE-2023-49090

    CarrierWave has a content-type allowlist bypass vulnerability, possibly leading to XSS

    CarrierWave is a solution for file uploads for Rails, Sinatra and other Ruby web frameworks. CarrierWave has a Content-Type allowlist bypass vulnerability, possibly leading to XSS. The validation in `allowlisted_content_type?` determines Content-Type permissi…

    carrierwaveuploader carrierwave carrierwave ruby-carrierwave Debian Ubuntu RubyGems

References

  • report
    https://ubuntu.com/security/CVE-2021-21305
  • report
    https://ubuntu.com/security/CVE-2023-49090