CVE-2014-0080

Array data injection vulnerability in activerecord

6.8 MediumFix available

CVE-2014-0080 is a medium vulnerability (CVSS 6.8) in Rubyonrails Rails, published February 20, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.27%, the 69th percentile. Fixed in activerecord 4.0.3.

SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql/cast.rb in Active Record in Ruby on Rails 4.0.x before 4.0.3, and 4.1.0.beta1, when PostgreSQL is used, allows remote attackers to execute "add data" SQL commands via vectors involving \ (backslash) characters that are not properly handled in operations on array columns.

Exploit likelihood

1.27%Up 0.2 points since Feb 4, 2022

What each source reports

NVD Score used 6.8

Record: CVE-2014-0080
CVSS 2.0: 6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness: CWE-89
Updated: 2026-11-02

CVE List No score

Record: CVE-2014-0080
Updated: 2026-11-02

EUVDEUVD-2017-0254 No score

Record: EUVD-2017-0254
Updated: 2026-11-03

GitHub AdvisoriesGHSA-hqf9-rc9j-5fmj No score

Array data injection vulnerability in activerecord

SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql/cast.rb in Active Record in Ruby on Rails 4.0.x before 4.0.3, and 4.1.0.beta1, when PostgreSQL is used, allows remote attackers to execute "add data" SQL commands via vectors involving \ (backslash) characters that are not properly handled in operations on array columns.

Record: GHSA-hqf9-rc9j-5fmj
Weakness: CWE-89
Updated: 2026-11-02

OSVGHSA-hqf9-rc9j-5fmj No score

Array data injection vulnerability in activerecord

Record: GHSA-hqf9-rc9j-5fmj
Weakness: CWE-89
Updated: 2026-11-02

OSVMGASA-2014-0191 No score

Updated ruby-rails and associated packages fix multiple vulnerabilities

Updated ruby-activerecord and ruby-actionpack packages fix security vulnerabilities:

There is a data injection vulnerability in Active Record. Specially crafted strings can be used to save data in PostgreSQL array columns that may not be intended (CVE-2014-0080).

There is an XSS vulnerability in the number_to_currency, number_to_percentage and number_to_human helpers in Ruby on Rails (CVE-2014-0081).

The associated packages have been updated to version 4.0.3 to fix these issues.

Record: MGASA-2014-0191
Updated: 2026-11-02

Affected products

rubyonrails rails

Affected packages

Affected packages
Package	Affected	Fixed
`activerecord` RubyGems	4.0.0 up to 4.0.3	4.0.3
`activerecord` RubyGems	4.1.0.beta1 to 4.1.0.beta1	4.1.0.beta2
`activerecord` RubyGems	4.0.0 up to 4.0.3, plus listed versions 4.0.14.0.1.rc14.0.1.rc24.0.1.rc34.0.1.rc44.0.2	4.0.3
`activerecord` RubyGems	4.1.0.beta1 up to 4.1.0.beta2	4.1.0.beta2
`ruby-actionmailer` Mageia:4	before 4.0.3-1.mga4	4.0.3-1.mga4
`ruby-actionpack` Mageia:4	before 4.0.3-1.mga4	4.0.3-1.mga4
`ruby-activemodel` Mageia:4	before 4.0.3-1.mga4	4.0.3-1.mga4
`ruby-activerecord` Mageia:4	before 4.0.3-1.mga4	4.0.3-1.mga4
`ruby-activesupport` Mageia:4	before 4.0.3-1.mga4	4.0.3-1.mga4
`ruby-rails` Mageia:4	before 4.0.3-1.mga4	4.0.3-1.mga4
`ruby-railties` Mageia:4	before 4.0.3-1.mga4	4.0.3-1.mga4

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV

References

Show 6 moreShow less