{"id":"CVE-2014-0080","aliases":["EUVD-2017-0254","GHSA-hqf9-rc9j-5fmj","MGASA-2014-0191"],"status":"published","title":"Array data injection vulnerability in activerecord","description":"SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql/cast.rb in Active Record in Ruby on Rails 4.0.x before 4.0.3, and 4.1.0.beta1, when PostgreSQL is used, allows remote attackers to execute \"add data\" SQL commands via vectors involving \\ (backslash) characters that are not properly handled in operations on array columns.","severity":{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01266,"percentile":0.69937,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-89"],"published":"2014-02-20T11:00:00Z","modified":"2026-06-17T00:02:13Z","fixes":[{"ecosystem":"RubyGems","package":"activerecord","fixed_in":["4.0.3","4.1.0.beta2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"RubyGems","package":"activerecord","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.0.3"}]}]},{"source":"ghsa","ecosystem":"RubyGems","package":"activerecord","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.0.beta1"},{"last_affected":"4.1.0.beta1"},{"fixed":"4.1.0.beta2"}]}],"versions":["4.1.0.beta1"]},{"source":"osv","ecosystem":"RubyGems","package":"activerecord","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.0.3"}]}],"versions":["4.0.0","4.0.1","4.0.1.rc1","4.0.1.rc2","4.0.1.rc3","4.0.1.rc4","4.0.2"]},{"source":"osv","ecosystem":"RubyGems","package":"activerecord","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.0.beta1"},{"fixed":"4.1.0.beta2"}]}],"versions":["4.1.0.beta1"]},{"source":"osv","ecosystem":"Mageia:4","package":"ruby-actionmailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.3-1.mga4"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:4","package":"ruby-actionpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.3-1.mga4"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:4","package":"ruby-activemodel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.3-1.mga4"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:4","package":"ruby-activerecord","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.3-1.mga4"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:4","package":"ruby-activesupport","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.3-1.mga4"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:4","package":"ruby-rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.3-1.mga4"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:4","package":"ruby-railties","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.3-1.mga4"}]}],"bundled":2}],"products":[{"vendor":"rubyonrails","product":"rails"}],"references":[{"url":"https://groups.google.com/forum/message/raw?msg=rubyonrails-security/Wu96YkTUR6s/pPLBMZrlwvYJ","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"http://openwall.com/lists/oss-security/2014/02/18/9","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-0080","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-hqf9-rc9j-5fmj","tags":["advisory"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activerecord/CVE-2014-0080.yml","tags":["web"]},{"url":"https://web.archive.org/web/20210301004521/https://groups.google.com/forum/message/raw?msg=rubyonrails-security/Wu96YkTUR6s/pPLBMZrlwvYJ","tags":["web"]},{"url":"https://github.com/rails/rails/tree/main/activerecord","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2014-0191.html","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/pipermail/package-announce/2014-March/129715.html","tags":["web"]},{"url":"https://lists.fedoraproject.org/pipermail/package-announce/2014-March/129716.html","tags":["web"]},{"url":"http://weblog.rubyonrails.org/2014/2/18/Rails_3_2_17_4_0_3_and_4_1_0_beta2_have_been_released/","tags":["web"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=12896","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2014-0080","description":"SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql/cast.rb in Active Record in Ruby on Rails 4.0.x before 4.0.3, and 4.1.0.beta1, when PostgreSQL is used, allows remote attackers to execute \"add data\" SQL commands via vectors involving \\ (backslash) characters that are not properly handled in operations on array columns.","status":"published","published":"2014-02-20T11:00:00Z","modified":"2024-08-06T09:05:37.826Z","updated_at":"2026-11-02T14:33:47.330011Z"}],"euvd":[{"id":"EUVD-2017-0254","description":"SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql/cast.rb in Active Record in Ruby on Rails 4.0.x before 4.0.3, and 4.1.0.beta1, when PostgreSQL is used, allows remote attackers to execute \"add data\" SQL commands via vectors involving \\ (backslash) characters that are not properly handled in operations on array columns.","status":"published","published":"2014-02-20T11:00:00Z","modified":"2024-08-06T09:05:37Z","updated_at":"2026-11-03T01:57:22.992Z"}],"ghsa":[{"id":"GHSA-hqf9-rc9j-5fmj","title":"Array data injection vulnerability in activerecord","description":"SQL injection vulnerability in `activerecord/lib/active_record/connection_adapters/postgresql/cast.rb` in Active Record in Ruby on Rails 4.0.x before 4.0.3, and 4.1.0.beta1, when PostgreSQL is used, allows remote attackers to execute \"add data\" SQL commands via vectors involving `\\` (backslash) characters that are not properly handled in operations on array columns.","status":"published","published":"2017-10-24T18:33:36Z","modified":"2023-11-08T05:04:10Z","cwes":["CWE-89"],"updated_at":"2026-11-02T14:37:16.721714Z"}],"nvd":[{"id":"CVE-2014-0080","description":"SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql/cast.rb in Active Record in Ruby on Rails 4.0.x before 4.0.3, and 4.1.0.beta1, when PostgreSQL is used, allows remote attackers to execute \"add data\" SQL commands via vectors involving \\ (backslash) characters that are not properly handled in operations on array columns.","status":"published","published":"2014-02-20T15:27:02.75Z","modified":"2026-06-17T00:02:13.403Z","cvss":[{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:02:53.330367Z"}],"osv":[{"id":"GHSA-hqf9-rc9j-5fmj","title":"Array data injection vulnerability in activerecord","description":"SQL injection vulnerability in `activerecord/lib/active_record/connection_adapters/postgresql/cast.rb` in Active Record in Ruby on Rails 4.0.x before 4.0.3, and 4.1.0.beta1, when PostgreSQL is used, allows remote attackers to execute \"add data\" SQL commands via vectors involving `\\` (backslash) characters that are not properly handled in operations on array columns.","status":"published","published":"2017-10-24T18:33:36Z","modified":"2024-12-08T05:37:06.824792Z","cwes":["CWE-89"],"updated_at":"2026-11-02T15:46:49.28217Z"},{"id":"MGASA-2014-0191","title":"Updated ruby-rails and associated packages fix multiple vulnerabilities","description":"Updated ruby-activerecord and ruby-actionpack packages fix security\nvulnerabilities:\n\nThere is a data injection vulnerability in Active Record. Specially crafted\nstrings can be used to save data in PostgreSQL array columns that may not be\nintended (CVE-2014-0080).\n\nThere is an XSS vulnerability in the number_to_currency, number_to_percentage\nand number_to_human helpers in Ruby on Rails (CVE-2014-0081).\n\nThe associated packages have been updated to version 4.0.3 to fix these\nissues.\n","status":"published","published":"2014-04-24T19:02:23Z","modified":"2026-04-16T06:25:57.156346688Z","updated_at":"2026-11-02T15:49:39.121227Z"}]}}