Skip to content
OpenAdvisories

Package · Debian

rails

132 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-122006 Public exploit

    The activestorage gem before 8.1.4.1 for Ruby on Rails, when ImageMagick attachment processing occurs, can allow server…

    rubyonrails Active Storage rails rails Debian Ubuntu
  • Critical 9.5
    CVE-2026-66066 Public exploit EPSS 33%

    Action Pack: Possible arbitrary file read and remote code execution in Active Storage variant processing

    Action Pack is a framework for handling and responding to web requests. In versions prior to 7.2.3.2, 8.0.5.1 and 8.1.3.1, Active Storage does not disable libvips operations marked unsafe for untrusted content, allowing a crafted upload to invoke such an oper…

    rails rails rails rails Debian Ubuntu RubyGems
  • Critical 9.2
    CVE-2025-24293 Public exploit

    Active Storage allowed transformation methods that were potentially unsafe

    # Active Storage allowed transformation methods potentially unsafe Active Storage attempts to prevent the use of potentially unsafe image transformation methods and parameters by default. The default allowed list contains three methods allow for the circumven…

    rails activestorage rails rails Debian Ubuntu RubyGems
  • Critical 9.8
    CVE-2022-32224 Public exploit

    Active Record RCE bug with Serialized Columns

    A possible escalation to RCE vulnerability exists when using YAML serialized columns in Active Record < 7.0.3.1, <6.1.6.1, <6.0.5.1 and <5.2.8.1 which could allow an attacker, that can manipulate data in the database (via means like SQL injection), the abilit…

    rails rails activerecord Debian Ubuntu RubyGems
  • Critical 9.8
    CVE-2022-21831 Public exploit

    Possible code injection vulnerability in Rails / Active Storage

    A code injection vulnerability exists in the Active Storage >= v5.2.0 that could allow an attacker to execute code via image_processing arguments.

    rails rails activestorage Debian Ubuntu RubyGems
  • Critical 9.8
    CVE-2020-8165 Public exploit EPSS 46%

    ActiveSupport potentially unintended unmarshalling of user-provided objects in MemCacheStore and RedisCacheStore

    A deserialization of untrusted data vulnernerability exists in rails < 5.2.4.3, rails < 6.0.3.1 that can allow an attacker to unmarshal user-provided objects in MemCacheStore and RedisCacheStore potentially resulting in an RCE.

    rails rails activesupport Debian Ubuntu RubyGems
  • Critical 9.8
    CVE-2019-5420 Public exploit EPSS 89%

    Use of Insufficiently Random Values in Railties Allows Remote Code Execution

    A remote code execution vulnerability in development mode Rails <5.2.2.1, <6.0.0.beta3 can allow an attacker to guess the automatically generated development mode secret token. This secret token can be used in combination with other Rails internals to escalat…

    rails https://github.com/rails/rails rails railties Debian RubyGems