Summary
Ein Angreifer kann mehrere Schwachstellen in Ruby on Rails ausnutzen, um beliebigen Programmcode auszuführen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Daten zu manipulieren, um falsche Informationen darzustellen, um einen Cross-Site Scripting Angriff durchzuführen und um Sicherheitsvorkehrungen zu umgehen.
Product
Ruby on Rails ist ein in der Programmiersprache Ruby geschriebenes und quelloffenes Web Application Framework.
Vulnerabilities 22
-
Critical 9.8CVE-2026-122006 Public exploit
Active Storage: Possible arbitrary file write and read in image analysis
The activestorage gem before 8.1.4.1 for Ruby on Rails, when ImageMagick attachment processing occurs, can allow server read and write operations (e.g., reading secret_key_base) because the ImageMagick analyzer runs when a file is attached, and there is not a…
-
Critical 9.8
-
High 8.8
Active Storage: Possible arbitrary file read and remote code execution in Active Storage video previews, analysis and image processing
Active Storage makes it simple to upload and reference files in cloud services and attach those files to Active Record objects. Prior to 8.1.4.1 and 8.0.5.2, ActiveStorage::Blob#open writes a blob to a tempfile whose name carries the extension of the uploaded…
-
High 7.5
Active Support: Possible DoS vulnerability in Active Support safe_constantize
Active Support is a collection of utility classes and standard library extensions used by Rails and other Ruby projects. Prior to 8.1.4.1 and 8.0.5.2, when constant lookup raises LoadError, ActiveSupport::Inflector#safe_constantize (and String#safe_constantiz…
-
High 7.5
Action Pack: Possible Strong Parameters bypass in Parameters#each_key
Action Pack is a framework for handling and responding to web requests. Prior to 8.1.4.1 and 8.0.5.2, ActionController::Parameters#each_key delegates to the internal ActiveSupport::HashWithIndifferentAccess that holds the request parameters, so when called wi…
-
High 7.4
Action Pack: Possible IP spoofing in Action Dispatch RemoteIp
Action Pack is a framework for handling and responding to web requests. From 8.1 until 8.1.4.1, Since Rails 8.1.0, ActionDispatch::RemoteIp derives request.remote_ip from Rack::Request#forwarded_for, which under Rack 3 reads the RFC 7239 Forwarded header in p…
-
Medium 6.8
Action Pack: Possible sensitive session information leak in Active Storage proxy mode
Action Pack is a framework for handling and responding to web requests. Prior to 8.1.4.1 and 8.0.5.2, When ActionDispatch::Cookies reads a signed or encrypted cookie that was written under a rotated secret (config.action_dispatch.cookies_rotations) or in the …
-
Medium 6.1
Action View: Possible XSS vulnerability in Action View strip_tags
Action View is a framework for handling view template lookup and rendering and provides view helpers for building HTML. Prior to 8.1.4.1 and 8.0.5.2, strip_tags in Action View returns its sanitized output marked html_safe, but the underlying sanitizer encodes…
-
Medium 6.1
Action View: Possible XSS vulnerability in Action View highlight helper
Action View is a framework for handling view template lookup and rendering and provides view helpers for building HTML. Prior to 8.1.4.1 and 8.0.5.2, ActionView::Helpers::TextHelper#highlight substitutes each matched phrase into the :highlighter string withou…
-
Medium 6.1
Action View: Possible XSS vulnerability in Action View text helpers
Action View is a framework for handling view template lookup and rendering and provides view helpers for building HTML. Prior to 8.1.4.1 and 8.0.5.2, with the HTML5 sanitizer (Rails::HTML5::Sanitizer, the default vendor on CRuby for applications using load_de…
-
Medium 5.9
Action Pack: Possible DoS vulnerability in Action Controller Live streaming
Action Pack is a framework for handling and responding to web requests. Prior to 8.1.4.1 and 8.0.5.2, ActionController::Live::Buffer#close pushes its end-of-stream marker onto the response's bounded queue while it holds the buffer's monitor. When the client h…
-
Medium 5.3
Active Storage: Possible DoS vulnerability in Active Storage proxy mode via storage errors during streaming
Active Storage makes it simple to upload and reference files in cloud services and attach those files to Active Record objects. From 8.0 until 8.0.5.2 and 8.1.4.1, when Active Storage serves a file through its proxy controllers, ActiveStorage::Streaming#send_…
-
Medium 5.3
Active Storage: Possible circumvention of file size limits in Active Storage direct uploads to Google Cloud Storage
Active Storage makes it simple to upload and reference files in cloud services and attach those files to Active Record objects. Prior to 8.1.4.1 and 8.0.5.2, ActiveStorage::Service::GCSService#url_for_direct_upload does not bind the declared content length in…
-
Medium 4.8
Action Pack: Possible cache poisoning in Action Pack content negotiation
Action Pack is a framework for handling and responding to web requests. Prior to 8.1.4.1 and 8.0.5.2, Action Pack negotiates the format of a rendered response from the Accept, X-Requested-With and, for XHR requests without Accept, Content-Type request headers…
-
Medium 4.7
Action View: Possible XSS vulnerability in Action View tag helpers
Action View is a framework for handling view template lookup and rendering and provides view helpers for building HTML. Prior to 8.1.4.1 and 8.0.5.2, the fix for CVE-2026-33168 skips blank HTML attribute names in Action View tag helpers, but it tests the name…
-
Medium 4.7
Active Support: Possible XSS vulnerability in Active Support MessagePack serializer
Active Support is a collection of utility classes and standard library extensions used by Rails and other Ruby projects. From 8.1 until 8.1.4.1, ActiveSupport::MessagePack serializes an ActiveSupport::SafeBuffer as its bytes alone and deserializes it as a new…
-
Medium 4.7
Active Storage: Unsigned Content-Type in Active Storage GCS direct uploads with cache_control
Active Storage makes it simple to upload and reference files in cloud services and attach those files to Active Record objects. Prior to 8.1.4.1 and 8.0.5.2, when a GCS service is configured with the cache_control option, ActiveStorage::Service::GCSService#ur…
-
Medium 4.3
Active Storage: Possible DoS vulnerability in Active Storage filename handling
Active Storage makes it simple to upload and reference files in cloud services and attach those files to Active Record objects. Prior to 8.1.4.1 and 8.0.5.2, ActiveStorage::Filename#base and #extension_with_delimiter, and therefore #extension, pass the stored…
-
Medium 4.2
Action Pack: Possible restoration of destroyed sessions in Action Dispatch CacheStore
Action Pack is a framework for handling and responding to web requests. Prior to 8.1.4.1 and 8.0.5.2, ActionDispatch::Session::CacheStore writes a session back to the cache at the end of each request that loaded it, without checking that the session's cache e…
-
Low 3.7
Action Mailbox: Possible signature replay in Action Mailbox Mailgun ingress
Action Mailbox routes incoming emails to controller-like mailboxes for processing in Rails. Prior to 8.1.4.1 and 8.0.5.2, the Action Mailbox Mailgun ingress authenticates a request with an HMAC of the timestamp and token parameters concatenated without a sepa…
-
Low 3.7
Active Storage: Possible local file disclosure in Active Storage video previews and analysis
Active Storage makes it simple to upload and reference files in cloud services and attach those files to Active Record objects. Prior to 8.0.5.2 and from 8.1 until 8.1.4.1, Active Storage's ActiveStorage::Previewer::VideoPreviewer, ActiveStorage::Analyzer::Vi…
-
Low 3.1
Action Pack: Missing SameSite attribute on session cookies from Action Pack session stores
Action Pack is a framework for handling and responding to web requests. Prior to 8.1.4.1 and 8.0.5.2, Action Pack session stores other than ActionDispatch::Session::CookieStore (CacheStore, MemCacheStore, and third-party stores built on AbstractStore, Abstrac…
Revision history
-
#3
Referenz(en) aufgenommen: CVE-2026-126067, EUVD-2026-122859, CVE-2026-126075, EUVD-2026-122911, CVE-2026-126074, EUVD-2026-122910, CVE-2026-126076, EUVD-2026-122925, CVE-2026-126069, EUVD-2026-122878, CVE-2026-126080, EUVD-2026-122930, CVE-2026-126068, EUVD-2026-122860, CVE-2026-126081, EUVD-2026-122932, CVE-2026-126077, EUVD-2026-122926, CVE-2026-126078, EUVD-2026-122927, CVE-2026-126082, EUVD-2026-122934, CVE-2026-126079, EUVD-2026-122928, CVE-2026-126071, EUVD-2026-122995, CVE-2026-126083, EUVD-2026-122936, CVE-2026-126072, EUVD-2026-123002, CVE-2026-126073, EUVD-2026-123003, CVE-2026-126070, EUVD-2026-122994, CVE-2026-126188, EUVD-2026-123059, CVE-2026-126186, EUVD-2026-122941, CVE-2026-126085, EUVD-2026-122939, CVE-2026-126084, EUVD-2026-122937
-
#2
Referenz(en) aufgenommen: CVE-2026-122006, EUVD-2026-116914
-
#1
Initiale Fassung
References
-
Rails security releases: 8.0.5.2 and 8.1.4.1 vom 2026-11-03
https://discuss.rubyonrails.org/t/rails-security-releases-8-0-5-2-and-8-1-4-1/91802