Active Record SQL Injection Vulnerability Affecting PostgreSQL #28449 Valid No weakness recorded – 2014-07-02 – 2 Active Record SQL Injection Vulnerability Affecting PostgreSQL #28450 Valid No weakness recorded – 2014-07-02 – 2 CSRF header is sent to external websites when using data-remote forms #189878 Valid Cross-Site Request Forgery – 2020-05-26 – 2 Untrusted strings that are cache fetched with raw option are automatically marshal loaded #413388 Valid Deserialization and Object Injection – 2020-05-26 – 2 Prevent XSS when passing a parameter directly into link_to #755354 Informative Cross-site Scripting – 2020-05-13 – 2 Escape Sequence Injection vulnerability in Rack #1411867 Valid No weakness recorded – 2023-06-28 – 2 rails-ujs will send CSRF tokens to other origins #49935 Valid Cross-Site Request Forgery – 2015-06-16 – 3 [Rails42] We can inject HTML tags when server is using strip_tags method #81396 Valid Cross-site Scripting – 2016-03-13 – 3 DoS Attack in Controller Lookup Code #83962 Valid Denial of Service – 2016-03-13 – 3 Untrusted users able to run pending migrations in production #899069 Valid Denial of Service – 2020-07-24 – 3 XSS by file (Active Storage `Proxying`) #949513 Valid Cross-site Scripting – 2020-09-01 $500 3 Possible DOS in app with crashing `exceptions_app` #1300802 Valid Denial of Service – 2023-06-28 – 3 Changeable model ids on vanilla update can lead to severely bad side-effects #63131 Informative Misconfiguration and Insecure Design – 2016-02-12 – 4 ActionController::Parameters .each returns an unsafe hash #292797 Valid No weakness recorded – 2020-05-18 – 4 Regex Injection from request header (Rack::Sendfile, send_file) #1057216 Informative Command and Code Injection – 2021-06-15 – 4 Arbitrary file existence disclosure in Action Pack #43440 Valid No weakness recorded – 2014-11-20 – 5 Potential XSS on sanitize/Rails::Html::WhiteListSanitizer #81212 Valid Cross-site Scripting – 2016-03-13 – 5 Validation bypass for Active Record and Active Model #108723 Valid Misconfiguration and Insecure Design – 2016-02-12 – 5 XSS by MathML at Active Storage #429873 Duplicate Cross-site Scripting – 2021-06-15 – 5 ActiveStorage direct upload fails to sign content-length header for S3 service #789579 Valid Input Validation and Logic – 2020-05-18 – 5 Server-side template injection at ujs test server #942103 Valid Command and Code Injection – 2021-02-16 – 5 Data-Tags and the New HTML Sanitizer Subverts CSRF protection #42728 Valid Cross-site Scripting – 2016-03-13 – 6 Regarding [CVE-2016-0752] Possible Information Leak Vulnerability in Action View #113831 Valid Command and Code Injection – 2016-03-01 – 6 HTTP Host injection in redirect_to function #888176 Informative Injection and Smuggling – 2021-06-15 – 6 http_basic_authenticate_with is suseptible to timing attacks. #94568 Valid Authentication – 2016-03-13 – 7 Remote code execution using render :inline #113928 Valid Command and Code Injection – 2016-03-01 $1,500 7 Unsafe Query Generation (CVE-2012-2660, CVE-2012-2694 and CVE-2013-0155) mitigation bypass #139321 Valid No weakness recorded – 2018-02-07 – 7 The authenticity_token can be reversed and used to forge valid per_form_csrf_tokens for arbitrary routes #732415 Valid Cross-Site Request Forgery – 2020-08-27 – 7 HostAuthorization middleware does not suitably sanitize the Host / X-Forwarded-For header allowing redirection. #1047447 Valid Open Redirect – 2021-02-11 – 7 Incomplete fix for CVE-2022-32209 (XSS in Rails::Html::Sanitizer under certain configurations) #1654310 Valid Cross-site Scripting – 2022-12-14 – 7 Directory traversal attack in view resolver #3370 Valid Information Disclosure – 2015-07-09 – 8 Denial of Service in Action Pack Exception Handling #42797 Valid Denial of Service – 2015-06-16 – 8 JSON keys are not properly escaped #47280 Valid Cross-site Scripting – 2015-06-16 – 8 ActiveStorage service's signed URLs can be hijacked via AppCache+Cookie stuffing trick when using GCS or DiskService #407319 Valid Information Disclosure – 2018-12-27 – 8 Rails::Html::SafeListSanitizer vulnerable to xss attack in an environment that allows the style tag #1530898 Valid Cross-site Scripting – 2022-06-14 – 8 Rails::Html::SafeListSanitizer vulnerable to XSS when certain tags are allowed (math+style || svg+style) #1656627 Valid Cross-site Scripting – 2022-12-14 – 8 Explicit, dynamic render path: Dir. Trav + RCE #46019 Valid Command and Code Injection – 2016-02-12 $500 9 Nested attributes reject_if proc can be circumvented by providing "_destroy" parameter #90457 Valid No weakness recorded – 2016-02-12 – 9 redirect_to(["string"]) remote code execution #1106652 Valid Information Disclosure – 2021-05-07 – 9 ReDoS (Rails::Html::PermitScrubber.scrub_attribute) #1684163 Valid No weakness recorded – 2023-01-02 – 11 RCE due to Web Console IP Whitelist bypass in Rails 4.0 and 4.1 #44513 Valid Command and Code Injection – 2015-06-16 – 13 XSS due to incomplete JS escaping #474262 Valid Cross-site Scripting – 2020-05-14 – 13 Missing resource identifier encoding may lead to security vulnerabilities #803922 Valid Information Disclosure – 2020-05-13 – 13 URI scheme validation bypass in ActionText `to_markdown` via user-supplied `<action-text-markdown>` marker tag #3727743 Valid Cross-site Scripting Medium 2026-08-24 – 13 Incorrect handling of certain characters passed to the redirection functionality in Rails can lead to a single-click XSS vulnerability. #1955370 Valid Cross-site Scripting – 2023-07-28 – 15 ActionText `to_markdown` still allows `javascript:` links in kramdown via Rails-generated table cells after PR #58754 #4082665 Informative Cross-site Scripting Medium 2026-10-10 – 15 Specially constructed multi-part requests cause multi-second response times; vulnerable to DoS #431561 Valid No weakness recorded – 2018-12-05 – 17 Subdomain Takeover at https://new.rubyonrails.org/ #1429148 Valid Access Control – 2022-03-03 – 17 XSS vulnerability in sanitize-method when parsing link's href #328270 Valid Cross-site Scripting – 2018-03-22 – 18 ReDoS in Rack::Multipart #1489141 Valid No weakness recorded – 2023-07-28 – 18