Medium GHSA-mpwp-4h2m-765c

Active Job - Object injection security vulnerability

Published Jan 16, 2026 · Updated Feb 3, 2026 · Assigned by GHSA

Description

Active Job vulnerability: An Active Job bug allowed String arguments to be deserialized as if they were Global IDs, an object injection security vulnerability.

Affected packages

Ecosystem	Package	Affected	Fixed	Record
RubyGems	activejob	< 4.2.0.beta2	4.2.0.beta2	GHSA-mpwp-4h2m-765c

References

https://advisories.gitlab.com/pkg/gem/activejob/OSVDB-112347 web
https://github.com/rails/rails package
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activejob/GHSA-mpwp-4h2m-765c.yml web
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activejob/OSVDB-112347.yml web