CVE-2013-3221
Active Record component in Ruby on Rails has a data-type injection vulnerability
CVE-2013-3221 is a medium vulnerability (CVSS 6.4) in Rubyonrails Rails, published April 22, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.40%, the 84th percentile. Fixed in activerecord 4.2.0.
The Active Record component in Ruby on Rails 2.3.x, 3.0.x, 3.1.x, and 3.2.x does not ensure that the declared data type of a database column is used during comparisons of input values to stored values in that column, which makes it easier for remote attackers to conduct data-type injection attacks against Ruby on Rails applications via a crafted value, as demonstrated by unintended interaction between the "typed XML" feature and a MySQL database.
Exploit likelihood
What each source reports
NVD Score used
The Active Record component in Ruby on Rails 2.3.x, 3.0.x, 3.1.x, and 3.2.x does not ensure that the declared data type of a database column is used during comparisons of input values to stored values in that column, which makes it easier for remote attackers to conduct data-type injection attacks against Ruby on Rails applications via a crafted value, as demonstrated by unintended interaction between the "typed XML" feature and a MySQL database.
- Record
CVE-2013-3221- CVSS 2.0
- 6.4 Medium
AV:N/AC:L/Au:N/C:P/I:P/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
The Active Record component in Ruby on Rails 2.3.x, 3.0.x, 3.1.x, and 3.2.x does not ensure that the declared data type of a database column is used during comparisons of input values to stored values in that column, which makes it easier for remote attackers to conduct data-type injection attacks against Ruby on Rails applications via a crafted value, as demonstrated by unintended interaction between the "typed XML" feature and a MySQL database.
- Record
CVE-2013-3221- Updated
- 2026-11-02
EUVDEUVD-2013-3159 No score
The Active Record component in Ruby on Rails 2.3.x, 3.0.x, 3.1.x, and 3.2.x does not ensure that the declared data type of a database column is used during comparisons of input values to stored values in that column, which makes it easier for remote attackers to conduct data-type injection attacks against Ruby on Rails applications via a crafted value, as demonstrated by unintended interaction between the "typed XML" feature and a MySQL database.
- Record
EUVD-2013-3159- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-f57c-hx33-hvh8
Active Record component in Ruby on Rails has a data-type injection vulnerability
The Active Record component in Ruby on Rails 2.3.x, 3.0.x, 3.1.x, and 3.2.x does not ensure that the declared data type of a database column is used during comparisons of input values to stored values in that column, which makes it easier for remote attackers to conduct data-type injection attacks against Ruby on Rails applications via a crafted value, as demonstrated by unintended interaction between the "typed XML" feature and a MySQL database.
- Record
GHSA-f57c-hx33-hvh8- CVSS 4.0
- 9.3 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-20, CWE-89
- Updated
- 2026-11-02
OSVGHSA-f57c-hx33-hvh8
Active Record component in Ruby on Rails has a data-type injection vulnerability
The Active Record component in Ruby on Rails 2.3.x, 3.0.x, 3.1.x, and 3.2.x does not ensure that the declared data type of a database column is used during comparisons of input values to stored values in that column, which makes it easier for remote attackers to conduct data-type injection attacks against Ruby on Rails applications via a crafted value, as demonstrated by unintended interaction between the "typed XML" feature and a MySQL database.
- Record
GHSA-f57c-hx33-hvh8- CVSS 4.0
- 9.3 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-20, CWE-89
- Updated
- 2026-11-02
OSV No score
The Active Record component in Ruby on Rails 2.3.x, 3.0.x, 3.1.x, and 3.2.x does not ensure that the declared data type of a database column is used during comparisons of input values to stored values in that column, which makes it easier for remote attackers to conduct data-type injection attacks against Ruby on Rails applications via a crafted value, as demonstrated by unintended interaction between the "typed XML" feature and a MySQL database.
- Record
CVE-2013-3221- Updated
- 2026-11-02
OSVDEBIAN-CVE-2013-3221 No score
The Active Record component in Ruby on Rails 2.3.x, 3.0.x, 3.1.x, and 3.2.x does not ensure that the declared data type of a database column is used during comparisons of input values to stored values in that column, which makes it easier for remote attackers to conduct data-type injection attacks against Ruby on Rails applications via a crafted value, as demonstrated by unintended interaction between the "typed XML" feature and a MySQL database.
- Record
DEBIAN-CVE-2013-3221- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
activerecordRubyGems |
before 4.2.0 | 4.2.0 |
railsDebian:12 |
before 2.3.14.1 | 2.3.14.1 |
railsDebian:13 |
before 2.3.14.1 | 2.3.14.1 |
railsDebian:14 |
before 2.3.14.1 | 2.3.14.1 |
activerecordRubyGems |
before 4.2.0, plus listed versions 1.0.01.1.01.10.01.10.11.11.0 Show 45 moreShow less1.11.11.12.11.12.21.13.01.13.11.13.21.14.01.14.11.14.21.14.31.14.41.15.01.15.11.15.21.15.31.15.41.15.51.15.61.2.01.3.01.4.01.5.01.5.11.6.01.7.01.8.01.9.01.9.12.0.02.0.12.0.22.0.42.0.52.1.02.1.12.1.22.2.22.2.32.3.102.3.112.3.122.3.142.3.152.3.162.3.17 |
4.2.0 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
pl.reddit.com/r/netsec/comments/17yajp/mysql_madness_and_rails
groups.google.com/group/rubyonrails-security/msg/1f3bc0b88a60c1ce?dmode=source&output=gplain
phenoelit.org/blog/archives/2013/02/index.html
openwall.com/lists/oss-security/2013/04/24/7
gist.github.com/dakull/5442275
Show 6 moreShow less
nvd.nist.gov/vuln/detail/CVE-2013-3221
github.com/rubysec/ruby-advisory-db/blob/master/gems/activerecord/CVE-2013-3221.yml
web.archive.org/web/20130825191249/http://www.phenoelit.org/blog/archives/2013/02/index.html
security-tracker.debian.org/tracker/CVE-2013-3221
Left out here: 205 versions. The JSON record has them.