Description
CarrierWave is an open-source RubyGem which provides a simple and flexible way to upload files from Ruby applications. In CarrierWave before versions 1.3.2 and 2.1.1, there is a code injection vulnerability. The "#manipulate!" method inappropriately evals the content of mutation option(:read/:write), allowing attackers to craft a string that can be executed as a Ruby code. If an application developer supplies untrusted inputs to the option, it will lead to remote code execution(RCE). This is fixed in versions 1.3.2 and 2.1.1.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| carrierwaveuploader | carrierwave | < 1.3.2, >= 2.0.0, < 2.1.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 12 | ruby-carrierwave | 1.3.2-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | ruby-carrierwave | No fix yet | — |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 24.04 LTS | ruby-carrierwave | 1.3.2-2ubuntu0.24.04.1~esm1 | USN-7497-1 |
| Ubuntu Pro 22.04 LTS | ruby-carrierwave | 1.3.2-2ubuntu0.22.04.1~esm1 | USN-7497-1 |
| Ubuntu Pro 20.04 LTS | ruby-carrierwave | 1.3.1-2ubuntu0.1~esm1 | USN-7497-1 |
| Ubuntu Pro 18.04 LTS | ruby-carrierwave | 1.2.2-1ubuntu0.1~esm1 | USN-7497-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| RubyGems | carrierwave | < 1.3.2 | 1.3.2 | GHSA-cf3w-g86h-35x4 |
| RubyGems | carrierwave | >= 2.0.0, < 2.1.1 | 2.1.1 | GHSA-cf3w-g86h-35x4 |
Advisories 1
- USN-7497-1 ruby-carrierwave vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
References
- https://github.com/carrierwaveuploader/carrierwave/blob/master/CHANGELOG.md#132---2021-02-08
- https://github.com/carrierwaveuploader/carrierwave/blob/master/CHANGELOG.md#211---2021-02-08
- https://github.com/carrierwaveuploader/carrierwave/security/advisories/GHSA-cf3w-g86h-35x4
- https://rubygems.org/gems/carrierwave
- https://github.com/carrierwaveuploader/carrierwave/commit/387116f5c72efa42bc3938d946b4c8d2f22181b7