CVE-2013-0156
actionpack Improper Input Validation vulnerability
active_support/core_ext/hash/conversions.rb in Ruby on Rails before 2.3.15, 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion.
Exploit likelihood
What each source reports
NVD Score used
active_support/core_ext/hash/conversions.rb in Ruby on Rails before 2.3.15, 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion.
- Record
CVE-2013-0156- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
active_support/core_ext/hash/conversions.rb in Ruby on Rails before 2.3.15, 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion.
- Record
CVE-2013-0156- Updated
- 2026-11-02
EUVDEUVD-2017-0264 No score
active_support/core_ext/hash/conversions.rb in Ruby on Rails before 2.3.15, 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion.
- Record
EUVD-2017-0264- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-jmgw-6vjg-jjwg No score
actionpack Improper Input Validation vulnerability
active_support/core_ext/hash/conversions.rb in Ruby on Rails before 2.3.15, 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion.
- Record
GHSA-jmgw-6vjg-jjwg- Weakness
- CWE-20
- Updated
- 2026-11-02
OSV No score
active_support/core_ext/hash/conversions.rb in Ruby on Rails before 2.3.15, 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion.
- Record
CVE-2013-0156- Updated
- 2026-11-02
OSVDEBIAN-CVE-2013-0156 No score
active_support/core_ext/hash/conversions.rb in Ruby on Rails before 2.3.15, 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion.
- Record
DEBIAN-CVE-2013-0156- Updated
- 2026-11-02
OSVGHSA-jmgw-6vjg-jjwg No score
actionpack Improper Input Validation vulnerability
active_support/core_ext/hash/conversions.rb in Ruby on Rails before 2.3.15, 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion.
- Record
GHSA-jmgw-6vjg-jjwg- Weakness
- CWE-20
- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10188-1 No score
ruby2.2-rubygem-extlib-0.9.16-7.4 on GA media
These are all security issues fixed in the ruby2.2-rubygem-extlib-0.9.16-7.4 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10188-1- Updated
- 2026-11-02
OSVUBUNTU-CVE-2013-0156 No score
active_support/core_ext/hash/conversions.rb in Ruby on Rails before 2.3.15, 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion.
- Record
UBUNTU-CVE-2013-0156- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
actionpackRubyGems |
before 2.3.15 | 2.3.15 |
actionpackRubyGems |
3.0.0 up to 3.0.19 | 3.0.19 |
actionpackRubyGems |
3.1.0 up to 3.1.10 | 3.1.10 |
actionpackRubyGems |
3.2.0 up to 3.2.11 | 3.2.11 |
railsDebian:12 |
before 2.3.14.1 | 2.3.14.1 |
railsDebian:13 |
before 2.3.14.1 | 2.3.14.1 |
railsDebian:14 |
before 2.3.14.1 | 2.3.14.1 |
railsDebian:6.0 |
before 2.3.5-1.2+squeeze4.1, plus listed versions 2.3.5-1.22.3.5-1.2+squeeze0.12.3.5-1.2+squeeze12.3.5-1.2+squeeze22.3.5-1.2+squeeze32.3.5-1.2+squeeze4 |
2.3.5-1.2+squeeze4.1 |
actionpackRubyGems |
before 2.3.15, plus listed versions 0.9.00.9.51.0.01.0.11.1.0 Show 45 moreShow less1.10.11.10.21.11.01.11.11.11.21.12.01.12.11.12.21.12.31.12.41.12.51.13.01.13.11.13.21.13.31.13.41.13.51.13.61.2.01.3.01.3.11.4.01.5.01.5.11.6.01.7.01.8.01.8.11.9.01.9.12.0.02.0.12.0.22.0.42.0.52.1.02.1.12.1.22.2.22.2.32.3.102.3.112.3.122.3.142.3.2 |
2.3.15 |
actionpackRubyGems |
3.0.0 up to 3.0.19, plus listed versions 3.0.13.0.103.0.10.rc13.0.113.0.12 Show 29 moreShow less3.0.12.rc13.0.133.0.13.rc13.0.143.0.153.0.163.0.173.0.183.0.23.0.33.0.43.0.4.rc13.0.53.0.5.rc13.0.63.0.6.rc13.0.6.rc23.0.73.0.7.rc13.0.7.rc23.0.83.0.8.rc13.0.8.rc23.0.8.rc43.0.93.0.9.rc13.0.9.rc33.0.9.rc43.0.9.rc5 |
3.0.19 |
Show 8 moreShow less
| Package | Affected | Fixed |
|---|---|---|
actionpackRubyGems |
3.1.0 up to 3.1.10, plus listed versions 3.1.13.1.1.rc13.1.1.rc23.1.1.rc33.1.2 Show 11 moreShow less3.1.2.rc13.1.2.rc23.1.33.1.43.1.4.rc13.1.53.1.5.rc13.1.63.1.73.1.83.1.9 |
3.1.10 |
actionpackRubyGems |
3.2.0 up to 3.2.11, plus listed versions 3.2.13.2.103.2.23.2.2.rc13.2.3 Show 15 moreShow less3.2.3.rc13.2.3.rc23.2.43.2.4.rc13.2.53.2.63.2.73.2.7.rc13.2.83.2.8.rc13.2.8.rc23.2.93.2.9.rc13.2.9.rc23.2.9.rc3 |
3.2.11 |
ruby193-rubygem-actionpackRed Hat:openshift:1::el6 |
before 1:3.2.8-2.el6 | 1:3.2.8-2.el6 |
ruby193-rubygem-actionpack-docRed Hat:openshift:1::el6 |
before 1:3.2.8-2.el6 | 1:3.2.8-2.el6 |
ruby193-rubygem-activesupportRed Hat:openshift:1::el6 |
before 1:3.2.8-3.el6 | 1:3.2.8-3.el6 |
rubygem-actionpackRed Hat:openshift:1::el6 |
before 1:3.0.13-2.1.el6op | 1:3.0.13-2.1.el6op |
rubygem-activesupportRed Hat:openshift:1::el6 |
before 1:3.0.13-2.el6op | 1:3.0.13-2.el6op |
rubygem-extlibopenSUSE:Tumbleweed |
before 0.9.16-7.4 | 0.9.16-7.4 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Ruby on Rails - XML Processor YAML Deserialization Code Execution (Metasploit) | 2013-01-10 |
| Exploit-DB | Ruby on Rails - Known Secret Session Cookie Remote Code Execution (Metasploit) | 2013-08-12 |
| Metasploit | Ruby on Rails Known Secret Session Cookie Remote Code Execution | 2013-04-11 |
| Metasploit | Ruby on Rails XML Processor YAML Deserialization Code Execution | 2013-01-07 |
| PoC in GitHub | 7s26simon/CVE-2013-0156 | 2025-12-11 |
| PoC in GitHub | Jjdt12/kuang_grade_mk11 | 2023-07-29 |
| PoC in GitHub | R3dKn33-zz/CVE-2013-0156 | 2019-05-27 |
| PoC in GitHub | bsodmike/rails-exploit-cve-2013-0156 | 2013-01-12 |
| PoC in GitHub | heroku/heroku-CVE-2013-0156 | 2013-01-11 |
| PoC in GitHub | josal/crack-0.1.8-fixed | 2013-01-11 |
| PoC in GitHub | oxben10/CVE-2013-0156 | 2024-11-13 |
| PoC in GitHub | terracatta/name_reverser | 2013-01-10 |
| Metasploit | Ruby on Rails XML Processor YAML Deserialization Scanner |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, exploits | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, Metasploit, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-0156 is a high vulnerability (CVSS 7.5) in Rubyonrails Rails, published January 9, 2013. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 99.4%, the 99th percentile. Fixed in actionpack 2.3.15.
References
groups.google.com/group/rubyonrails-security/msg/c1432d0f8c70e89d?dmode=source&output=gplain
insinuator.net/2013/01/rails-yaml
rhn.redhat.com/errata/RHSA-2013-0155.html
kb.cert.org/vuls/id/628463
community.rapid7.com/community/metasploit/blog/2013/01/09/serialization-mischief-in-ruby-land-cve-2013-0156
fujitsu.com/global/support/software/security/products-f/sw-sv-rcve-ror201301e.html
Show 25 moreShow less
lists.apple.com/archives/security-announce/2013/Mar/msg00002.html
debian.org/security/2013/dsa-2604
ics-cert.us-cert.gov/advisories/ICSA-13-036-01A
puppet.com/security/cve/cve-2013-0156
weblog.rubyonrails.org/2013/1/28/Rails-3-0-20-and-2-3-16-have-been-released
nvd.nist.gov/vuln/detail/CVE-2013-0156
web.archive.org/web/20140111025708/http://lists.apple.com/archives/security-announce/2013/Mar/msg00002.html
github.com/advisories/GHSA-jmgw-6vjg-jjwg
security-tracker.debian.org/tracker/CVE-2013-0156
access.redhat.com/errata/RHSA-2013:0153
bugzilla.redhat.com/show_bug.cgi?id=892870
security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_0153.json
cve.org/CVERecord?id=CVE-2013-0156
ubuntu.com/security/CVE-2013-0156
openwall.com/lists/oss-security/2013/01/08/14
suse.com/security/cve/CVE-2013-0156
Left out here: 9 versions. The JSON record has them.