Rails vulnerabilities

Products

• Https://github.com/rails/rails 30
• Rails 15
• Rails-html-sanitizer 11
• Activestorage 6
• Activesupport 5
• Actionview 3
• Ruby On Rails 3

Newest

• rails Action Pack: Possible arbitrary file read and remote code execution in Active Storage variant processing CVE-2026-66066 Public exploitFix available EPSS 30.1% 9.5 CriticalJuly 30, 2026
• rails rails-html-sanitizer rails-html-sanitizer: Possible XSS vulnerability with certain configurations CVE-2026-73648 Fix available 5.1 MediumJuly 21, 2026
• rubyonrails rails, rails activestorage +1 more Rails Active Storage has a possible DoS vulnerability in proxy mode via multi-range requests CVE-2026-33658 Fix available 2.3 LowMarch 25, 2026
• rubyonrails rails, rails activestorage +1 more Rails Active Storage has possible glob injection in its DiskService CVE-2026-33202 Fix available 6.6 MediumMarch 23, 2026
• rubyonrails rails, rails activestorage, red hat 3scale api management platform 2 +2 more Rails Active Storage has possible Path Traversal in DiskService CVE-2026-33195 Fix available 8.0 HighMarch 23, 2026
• rubyonrails rails, rails activesupport +1 more Rails Active Support has a possible DoS vulnerability in its number helpers CVE-2026-33176 Fix available 6.6 MediumMarch 23, 2026
• rubyonrails rails, rails activestorage +1 more Rails Active Storage has a possible DoS vulnerability when in proxy mode via Range requests CVE-2026-33174 Fix available 6.6 MediumMarch 23, 2026
• rubyonrails rails, rails activestorage +1 more Rails Active Storage has possible content type bypass via metadata in direct uploads CVE-2026-33173 Fix available 5.3 MediumMarch 23, 2026
• rubyonrails rails, rails activesupport +1 more Rails Active Support has a possible XSS vulnerability in SafeBuffer#% CVE-2026-33170 Fix available 5.3 MediumMarch 23, 2026
• rubyonrails rails, rails activesupport +1 more Rails Active Support has a possible ReDoS vulnerability in number_to_delimited CVE-2026-33169 Fix available 6.9 MediumMarch 23, 2026
• rails actionview Rails has a possible XSS vulnerability in its Action View tag helpers CVE-2026-33168 Fix available 2.3 LowMarch 23, 2026
• rubyonrails rails, rails actionpack +1 more Rails has a possible XSS vulnerability in its Action Pack debug exceptions CVE-2026-33167 Fix available 1.3 LowMarch 23, 2026
• rails activestorage, red hat 3scale api management platform 2, satellite 6 +2 more Active Storage allowed transformation methods that were potentially unsafe CVE-2025-24293 Public exploitFix available 9.2 CriticalAugust 14, 2025
• rails Active Record logging vulnerable to ANSI escape injection CVE-2025-55193 Fix available 2.7 LowAugust 13, 2025
• rails Possible Content Security Policy bypass in Action Dispatch CVE-2024-54133 Fix available 2.3 LowDecember 10, 2024
• rails rails-html-sanitizer, rubyonrails rails html sanitizers +1 more Possible XSS vulnerability with certain configurations of rails-html-sanitizer 1.6.0 CVE-2024-53985 Fix available 2.3 LowDecember 2, 2024
• rails rails-html-sanitizer, rubyonrails rails html sanitizers +1 more Possible XSS vulnerability with certain configurations of rails-html-sanitizer 1.6.0 CVE-2024-53987 Fix available 2.3 LowDecember 2, 2024
• rails rails-html-sanitizer, rubyonrails rails html sanitizers +1 more Possible XSS vulnerability with certain configurations of rails-html-sanitizer 1.6.0 CVE-2024-53986 Fix available 2.3 LowDecember 2, 2024
• rails rails-html-sanitizer, rubyonrails rails html sanitizers +1 more Possible XSS vulnerability with certain configurations of rails-html-sanitizer 1.6.0 CVE-2024-53988 Fix available 2.3 LowDecember 2, 2024
• rails rails-html-sanitizer, rubyonrails rails html sanitizers +1 more Possible XSS vulnerability with certain configurations of rails-html-sanitizer 1.6.0 CVE-2024-53989 Fix available 2.3 LowDecember 2, 2024
• rails Action Mailer has possible ReDoS vulnerability in block_format CVE-2024-47889 Fix available 6.6 MediumOctober 15, 2024
• rails Action Text has possible ReDoS vulnerability in plain_text_for_blockquote_node CVE-2024-47888 Fix available 6.6 MediumOctober 15, 2024
• rails Action Controller has possible ReDoS vulnerability in HTTP Token authentication CVE-2024-47887 Fix available 6.6 MediumOctober 15, 2024
• rails Action Dispatch has possible ReDoS vulnerability in query parameter filtering CVE-2024-41128 Fix available 6.6 MediumOctober 15, 2024
• rails ActionText ContentAttachment can Contain Unsanitized HTML CVE-2024-32464 Fix available 6.1 MediumJune 4, 2024
• rails Action Pack is missing security headers on non-HTML responses CVE-2024-28103 Fix available 5.4 MediumJune 4, 2024
• rails Possible Sensitive Session Information Leak in Active Storage CVE-2024-26144 Public exploitFix available 5.3 MediumFebruary 27, 2024
• rails Rails Possible XSS Vulnerability in Action Controller CVE-2024-26143 Fix available 6.1 MediumFebruary 27, 2024
• rails Rails possible ReDoS vulnerability in Accept header parsing in Action Dispatch CVE-2024-26142 Fix available 7.5 HighFebruary 27, 2024
• rails activesupport Active Support Possibly Discloses Locally Encrypted Files CVE-2023-38037 Fix available 5.5 MediumAugust 23, 2023
• rails action pack Actionpack has possible cross-site scripting vulnerability via User Supplied Values to redirect_to CVE-2023-28362 Fix available 4.0 MediumJune 29, 2023
• rails kredis json Kredis JSON Possible Deserialization of Untrusted Data Vulnerability CVE-2023-27531 Fix available 5.3 MediumJune 9, 2023
• rails rails-ujs rails-ujs vulnerable to DOM Based Cross-site Scripting contenteditable HTML Elements CVE-2023-23913 Fix available 6.3 MediumApril 14, 2023
• rack, debian linux +1 more Possible Denial of Service Vulnerability in Rack's header parsing CVE-2023-27539 Fix available 5.3 MediumMarch 15, 2023
• rails activesupport Possible XSS Security Vulnerability in SafeBuffer#bytesplice CVE-2023-28120 Fix available 5.3 MediumMarch 15, 2023
• rails https://github.com/rails/rails, rubyonrails rails +1 more ReDoS based DoS vulnerability in Action Dispatch CVE-2023-22792 Fix available 7.5 HighJanuary 18, 2023
• activesupport project activesupport, rails https://github.com/rails/rails +1 more ReDoS based DoS vulnerability in Active Support's underscore CVE-2023-22796 Fix available 7.5 HighJanuary 18, 2023
• rubyonrails rails, actionpack project actionpack, rails https://github.com/rails/rails +2 more Open Redirect Vulnerability in Action Pack CVE-2023-22797 Fix available 6.1 MediumJanuary 18, 2023
• activerecord project activerecord, rails https://github.com/rails/rails +1 more Denial of Service Vulnerability in ActiveRecord's PostgreSQL adapter CVE-2022-44566 Fix available 7.5 HighJanuary 18, 2023
• debian linux, rails https://github.com/rails/rails, rubyonrails rails +2 more ReDoS based DoS vulnerability in Action Dispatch CVE-2023-22795 Fix available 7.5 HighJanuary 18, 2023
• activerecord project activerecord, rails https://github.com/rails/rails +1 more SQL Injection Vulnerability via ActiveRecord comments CVE-2023-22794 Fix available 8.8 HighJanuary 18, 2023
• rails rails-html-sanitizer, debian linux, rubyonrails rails html sanitizers +2 more rails-html-sanitizer contains an incomplete fix for an XSS vulnerability CVE-2022-23520 Fix available 6.1 MediumDecember 13, 2022
• rails rails-html-sanitizer, debian linux, rubyonrails rails html sanitizers +2 more Possible XSS vulnerability with certain configurations of rails-html-sanitizer CVE-2022-23519 Fix available 7.2 HighDecember 13, 2022
• loofah project loofah, rails rails-html-sanitizer, debian linux +1 more +3 more Improper neutralization of data URIs allows XSS in rails-html-sanitizer CVE-2022-23518 Fix available 6.1 MediumDecember 13, 2022
• rails rails-html-sanitizer, debian linux, rubyonrails rails html sanitizers +2 more Inefficient Regular Expression Complexity in rails-html-sanitizer CVE-2022-23517 Fix available 7.5 HighDecember 13, 2022
• activerecord project activerecord, rails https://github.com/rails/rails +1 more Active Record RCE bug with Serialized Columns CVE-2022-32224 Public exploitFix available 9.8 CriticalJuly 12, 2022
• debian linux, rails https://github.com/rails/rails, rubyonrails actionpack +2 more XSS Vulnerability in Action View tag helpers CVE-2022-27777 Fix available 6.1 MediumApril 27, 2022
• debian linux, rails https://github.com/rails/rails, rubyonrails actionpack +2 more Cross-site Scripting Vulnerability in Action Pack CVE-2022-22577 Fix available 6.1 MediumApril 27, 2022
• rubyonrails active storage, debian linux, rails https://github.com/rails/rails +2 more Possible code injection vulnerability in Rails / Active Storage CVE-2022-21831 Public exploitFix available 9.8 CriticalMarch 8, 2022
• rails, debian linux +1 more Exposure of sensitive information in Action Pack CVE-2022-23633 Fix available 7.4 HighFebruary 11, 2022
• Show olderLoading…