{"id":"CVE-2022-21831","aliases":["DEBIAN-CVE-2022-21831","DLA-3093-1","DSA-5372-1","EUVD-2022-1564","GHSA-w749-p3v6-hccq","UBUNTU-CVE-2022-21831","openSUSE-SU-2024:11903-1","openSUSE-SU-2024:12880-1","openSUSE-SU-2024:14070-1","openSUSE-SU-2025:15113-1"],"status":"published","title":"Possible code injection vulnerability in Rails / Active Storage","description":"A code injection vulnerability exists in the Active Storage \u003e= v5.2.0 that could allow an attacker to execute code via image_processing arguments.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.03098,"percentile":0.87854,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-94"],"published":"2022-03-08T21:25:54Z","modified":"2026-11-03T08:03:49Z","exploits":[{"source":"pocgithub","id":"usutani/study-turbolinks-link","title":"usutani/study-turbolinks-link","date":"2020-04-05","url":"https://github.com/usutani/study-turbolinks-link"}],"fixes":[{"ecosystem":"RubyGems","package":"activestorage","fixed_in":["5.2.6.3","6.0.4.7","6.1.4.7","7.0.2.3"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"rails","fixed_in":["2:6.1.4.7+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"rails","fixed_in":["2:6.1.4.7+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"rails","fixed_in":["2:6.1.4.7+dfsg-1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"rubygem-activestorage-7.0","fixed_in":["7.0.2.3-1.1","7.0.8.4-1.1","7.0.8.6-1.3"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"ruby3.2-rubygem-activestorage-7.0","fixed_in":["7.0.4.3-1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"RubyGems","package":"activestorage","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.0"},{"last_affected":"5.2.6.2"},{"fixed":"5.2.6.3"}]}]},{"source":"ghsa","ecosystem":"RubyGems","package":"activestorage","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"last_affected":"6.0.4.6"},{"fixed":"6.0.4.7"}]}]},{"source":"ghsa","ecosystem":"RubyGems","package":"activestorage","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.0"},{"last_affected":"6.1.4.6"},{"fixed":"6.1.4.7"}]}]},{"source":"ghsa","ecosystem":"RubyGems","package":"activestorage","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"last_affected":"7.0.2.2"},{"fixed":"7.0.2.3"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:6.1.4.7+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:6.1.4.7+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:6.1.4.7+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:5.2.2.1+dfsg-1+deb10u4"}]}],"versions":["2:5.2.2.1+dfsg-1","2:5.2.2.1+dfsg-1+deb10u1","2:5.2.2.1+dfsg-1+deb10u2","2:5.2.2.1+dfsg-1+deb10u3"],"bundled":4},{"source":"osv","ecosystem":"Debian:11","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:6.0.3.7+dfsg-2+deb11u1"}]}],"versions":["2:6.0.3.7+dfsg-2"],"bundled":10},{"source":"osv","ecosystem":"RubyGems","package":"activestorage","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.0"},{"fixed":"5.2.6.3"}]}],"versions":["5.2.0","5.2.1","5.2.1.1","5.2.1.rc1","5.2.2","5.2.2.1","5.2.2.rc1","5.2.3","5.2.3.rc1","5.2.4","5.2.4.1","5.2.4.2","5.2.4.3","5.2.4.4","5.2.4.5","5.2.4.6","5.2.4.rc1","5.2.5","5.2.6","5.2.6.1","5.2.6.2"]},{"source":"osv","ecosystem":"RubyGems","package":"activestorage","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.4.7"}]}],"versions":["6.0.0","6.0.1","6.0.1.rc1","6.0.2","6.0.2.1","6.0.2.2","6.0.2.rc1","6.0.2.rc2","6.0.3","6.0.3.1","6.0.3.2","6.0.3.3","6.0.3.4","6.0.3.5","6.0.3.6","6.0.3.7","6.0.3.rc1","6.0.4","6.0.4.1","6.0.4.2","6.0.4.3","6.0.4.4","6.0.4.5","6.0.4.6"]},{"source":"osv","ecosystem":"RubyGems","package":"activestorage","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.0"},{"fixed":"6.1.4.7"}]}],"versions":["6.1.0","6.1.1","6.1.2","6.1.2.1","6.1.3","6.1.3.1","6.1.3.2","6.1.4","6.1.4.1","6.1.4.2","6.1.4.3","6.1.4.4","6.1.4.5","6.1.4.6"]},{"source":"osv","ecosystem":"RubyGems","package":"activestorage","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.0.2.3"}]}],"versions":["7.0.0","7.0.1","7.0.2","7.0.2.1","7.0.2.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:4.1.10-1","2:4.2.5-1","2:4.2.5.1-1","2:4.2.5.2-2","2:4.2.6-1","2:4.2.6-1ubuntu0.1~esm1","2:4.2.6-1ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:4.2.9-2","2:4.2.9-4","2:4.2.10-0ubuntu4","2:4.2.10-0ubuntu4+esm1","2:4.2.10-0ubuntu4+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:5.2.2.1+dfsg-1ubuntu1","2:5.2.3+dfsg-3","2:5.2.3+dfsg-3ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:6.0.3.7+dfsg-2","2:6.1.4.1+dfsg-8ubuntu2","2:6.1.4.1+dfsg-8ubuntu2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:6.1.7.3+dfsg-2build1","2:6.1.7.3+dfsg-3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:6.1.7.3+dfsg-7","2:7.2.2.1+dfsg-7"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:7.2.3+dfsg-2","2:7.2.3.2+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:7.2.2.1+dfsg-7","2:7.2.2.2+dfsg-2","2:7.2.3+dfsg-2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rubygem-activestorage-7.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.2.3-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ruby3.2-rubygem-activestorage-7.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.4.3-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rubygem-activestorage-7.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.8.4-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rubygem-activestorage-7.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.8.6-1.3"}]}]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"rails","product":"https://github.com/rails/rails"},{"vendor":"rubyonrails","product":"active_storage"}],"references":[{"url":"https://github.com/advisories/GHSA-w749-p3v6-hccq","tags":["x_transferred","Patch","Third Party Advisory","fix","advisory","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/09/msg00002.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://security.netapp.com/advisory/ntap-20221118-0001/","tags":["x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.debian.org/security/2023/dsa-5372","tags":["vendor-advisory","x_transferred","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-21831","tags":["advisory"]},{"url":"https://github.com/rails/rails/commit/0a72f7d670e9aa77a0bb8584cb1411ddabb7546e","tags":["web"]},{"url":"https://groups.google.com/g/rubyonrails-security/c/n-p-W1yxatI","tags":["web"]},{"url":"https://rubysec.com/advisories/CVE-2022-21831/"},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activestorage/CVE-2022-21831.yml","tags":["web"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-21831","tags":["advisory"]},{"url":"https://github.com/rails/rails","tags":["package"]},{"url":"https://rubysec.com/advisories/CVE-2022-21831","tags":["web"]},{"url":"https://security.netapp.com/advisory/ntap-20221118-0001","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2022-21831","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-21831","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2022-21831","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/46EQRIAH3FLDMDVYDHYXRLAPYFUK6NA6/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-21831","description":"A code injection vulnerability exists in the Active Storage \u003e= v5.2.0 that could allow an attacker to execute code via image_processing arguments.","status":"published","published":"2022-05-26T00:00:00Z","modified":"2024-08-03T02:53:36.3Z","cwes":["CWE-94"],"updated_at":"2026-11-02T14:34:29.057251Z"}],"euvd":[{"id":"EUVD-2022-1564","description":"A code injection vulnerability exists in the Active Storage \u003e= v5.2.0 that could allow an attacker to execute code via image_processing arguments.","status":"published","published":"2022-05-26T00:00:00Z","modified":"2024-08-03T02:53:36Z","updated_at":"2026-11-03T03:25:54.006451Z"}],"ghsa":[{"id":"GHSA-w749-p3v6-hccq","title":"Possible code injection vulnerability in Rails / Active Storage","description":"The Active Storage module of Rails starting with version 5.2.0 is possibly vulnerable to code injection. This issue was patched in versions 5.2.6.3, 6.0.4.7, 6.1.4.7, and 7.0.2.3. To work around this issue, applications should implement a strict allow-list on accepted transformation methods or arguments.  Additionally, a strict ImageMagick security policy will help mitigate this issue.","status":"published","published":"2022-03-08T21:25:54Z","modified":"2023-03-22T05:03:30Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:36:48.041653Z"}],"nvd":[{"id":"CVE-2022-21831","description":"A code injection vulnerability exists in the Active Storage \u003e= v5.2.0 that could allow an attacker to execute code via image_processing arguments.","status":"published","published":"2022-05-26T17:15:09.017Z","modified":"2026-06-17T04:27:03.96Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:07:21.261605Z"}],"osv":[{"id":"CVE-2022-21831","description":"A code injection vulnerability exists in the Active Storage \u003e= v5.2.0 that could allow an attacker to execute code via image_processing arguments.","status":"published","published":"2022-05-26T17:15:09.017Z","modified":"2026-03-15T22:43:35.222099Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:24.061177Z"},{"id":"DEBIAN-CVE-2022-21831","description":"A code injection vulnerability exists in the Active Storage \u003e= v5.2.0 that could allow an attacker to execute code via image_processing arguments.","status":"published","published":"2022-05-26T17:15:09.017Z","modified":"2026-11-03T08:03:49.87762076Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T08:23:57.167851Z"},{"id":"GHSA-w749-p3v6-hccq","title":"Possible code injection vulnerability in Rails / Active Storage","description":"The Active Storage module of Rails starting with version 5.2.0 is possibly vulnerable to code injection. This issue was patched in versions 5.2.6.3, 6.0.4.7, 6.1.4.7, and 7.0.2.3. To work around this issue, applications should implement a strict allow-list on accepted transformation methods or arguments.  Additionally, a strict ImageMagick security policy will help mitigate this issue.","status":"published","published":"2022-03-08T21:25:54Z","modified":"2026-03-13T22:14:30.413627Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:46:58.401149Z"},{"id":"UBUNTU-CVE-2022-21831","description":"A code injection vulnerability exists in the Active Storage \u003e= v5.2.0 that could allow an attacker to execute code via image_processing arguments.","status":"published","published":"2022-05-26T17:15:00Z","modified":"2026-10-17T12:56:21.926357185Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:53:52.391598Z"},{"id":"DLA-3093-1","title":"rails - security update","status":"published","published":"2022-09-03T00:00:00Z","modified":"2026-03-09T01:21:13.821056Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"DSA-5372-1","title":"rails - security update","status":"published","published":"2023-03-13T00:00:00Z","modified":"2026-03-09T02:11:20.548457Z","updated_at":"2026-11-02T15:46:17.543497Z"},{"id":"openSUSE-SU-2024:11903-1","title":"ruby3.1-rubygem-activestorage-7.0-7.0.2.3-1.1 on GA media","description":"These are all security issues fixed in the ruby3.1-rubygem-activestorage-7.0-7.0.2.3-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:36:17.447926Z","updated_at":"2026-11-02T16:58:35.485255Z"},{"id":"openSUSE-SU-2024:12880-1","title":"ruby3.2-rubygem-activestorage-7.0-7.0.4.3-1.1 on GA media","description":"These are all security issues fixed in the ruby3.2-rubygem-activestorage-7.0-7.0.4.3-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:34:25.839935Z","updated_at":"2026-11-02T16:58:36.025801Z"},{"id":"openSUSE-SU-2024:14070-1","title":"ruby3.3-rubygem-activestorage-7.0-7.0.8.4-1.1 on GA media","description":"These are all security issues fixed in the ruby3.3-rubygem-activestorage-7.0-7.0.8.4-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-24T00:00:00Z","modified":"2026-02-04T04:28:57.031191Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"openSUSE-SU-2025:15113-1","title":"ruby3.4-rubygem-activestorage-7.0-7.0.8.6-1.3 on GA media","description":"These are all security issues fixed in the ruby3.4-rubygem-activestorage-7.0-7.0.8.6-1.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-05-17T00:00:00Z","modified":"2025-05-22T10:59:08.122982Z","updated_at":"2026-11-02T16:58:37.399567Z"}]}}