Active Record SQL Injection Vulnerability Affecting PostgreSQL #28449 Valid No weakness recorded – 2014-07-02 – 2 Active Record SQL Injection Vulnerability Affecting PostgreSQL #28450 Valid No weakness recorded – 2014-07-02 – 2 CSRF header is sent to external websites when using data-remote forms #189878 Valid Cross-Site Request Forgery Low 2020-05-26 – 2 Untrusted strings that are cache fetched with raw option are automatically marshal loaded #413388 Valid Deserialization and Object Injection High 2020-05-26 – 2 Escape Sequence Injection vulnerability in Rack #1411867 Valid No weakness recorded Medium 2023-06-28 – 2 rails-ujs will send CSRF tokens to other origins #49935 Valid Cross-Site Request Forgery – 2015-06-16 – 3 [Rails42] We can inject HTML tags when server is using strip_tags method #81396 Valid Cross-site Scripting – 2016-03-13 – 3 DoS Attack in Controller Lookup Code #83962 Valid Denial of Service – 2016-03-13 – 3 Untrusted users able to run pending migrations in production #899069 Valid Denial of Service Medium 2020-07-24 – 3 XSS by file (Active Storage `Proxying`) #949513 Valid Cross-site Scripting Medium 2020-09-01 $500 3 Possible DOS in app with crashing `exceptions_app` #1300802 Valid Denial of Service Medium 2023-06-28 – 3 ActionController::Parameters .each returns an unsafe hash #292797 Valid No weakness recorded Medium 2020-05-18 – 4 Arbitrary file existence disclosure in Action Pack #43440 Valid No weakness recorded – 2014-11-20 – 5 Potential XSS on sanitize/Rails::Html::WhiteListSanitizer #81212 Valid Cross-site Scripting – 2016-03-13 – 5 Validation bypass for Active Record and Active Model #108723 Valid Misconfiguration and Insecure Design Medium 2016-02-12 – 5 ActiveStorage direct upload fails to sign content-length header for S3 service #789579 Valid Input Validation and Logic Medium 2020-05-18 – 5 Server-side template injection at ujs test server #942103 Valid Command and Code Injection None 2021-02-16 – 5 Data-Tags and the New HTML Sanitizer Subverts CSRF protection #42728 Valid Cross-site Scripting – 2016-03-13 – 6 Regarding [CVE-2016-0752] Possible Information Leak Vulnerability in Action View #113831 Valid Command and Code Injection – 2016-03-01 – 6 http_basic_authenticate_with is suseptible to timing attacks. #94568 Valid Authentication – 2016-03-13 – 7 Remote code execution using render :inline #113928 Valid Command and Code Injection – 2016-03-01 $1,500 7 Unsafe Query Generation (CVE-2012-2660, CVE-2012-2694 and CVE-2013-0155) mitigation bypass #139321 Valid No weakness recorded – 2018-02-07 – 7 The authenticity_token can be reversed and used to forge valid per_form_csrf_tokens for arbitrary routes #732415 Valid Cross-Site Request Forgery Medium 2020-08-27 – 7 HostAuthorization middleware does not suitably sanitize the Host / X-Forwarded-For header allowing redirection. #1047447 Valid Open Redirect Low 2021-02-11 – 7 Incomplete fix for CVE-2022-32209 (XSS in Rails::Html::Sanitizer under certain configurations) #1654310 Valid Cross-site Scripting Medium 2022-12-14 – 7 Directory traversal attack in view resolver #3370 Valid Information Disclosure – 2015-07-09 – 8 Denial of Service in Action Pack Exception Handling #42797 Valid Denial of Service – 2015-06-16 – 8 JSON keys are not properly escaped #47280 Valid Cross-site Scripting High 2015-06-16 – 8 ActiveStorage service's signed URLs can be hijacked via AppCache+Cookie stuffing trick when using GCS or DiskService #407319 Valid Information Disclosure High 2018-12-27 – 8 Rails::Html::SafeListSanitizer vulnerable to xss attack in an environment that allows the style tag #1530898 Valid Cross-site Scripting Medium 2022-06-14 – 8 Rails::Html::SafeListSanitizer vulnerable to XSS when certain tags are allowed (math+style || svg+style) #1656627 Valid Cross-site Scripting Medium 2022-12-14 – 8 Explicit, dynamic render path: Dir. Trav + RCE #46019 Valid Command and Code Injection High 2016-02-12 $500 9 Nested attributes reject_if proc can be circumvented by providing "_destroy" parameter #90457 Valid No weakness recorded High 2016-02-12 – 9 redirect_to(["string"]) remote code execution #1106652 Valid Information Disclosure Low 2021-05-07 – 9 ReDoS (Rails::Html::PermitScrubber.scrub_attribute) #1684163 Valid No weakness recorded – 2023-01-02 – 11 RCE due to Web Console IP Whitelist bypass in Rails 4.0 and 4.1 #44513 Valid Command and Code Injection – 2015-06-16 – 13 XSS due to incomplete JS escaping #474262 Valid Cross-site Scripting Low 2020-05-14 – 13 Missing resource identifier encoding may lead to security vulnerabilities #803922 Valid Information Disclosure Medium 2020-05-13 – 13 URI scheme validation bypass in ActionText `to_markdown` via user-supplied `<action-text-markdown>` marker tag #3727743 Valid Cross-site Scripting Medium 2026-08-24 – 13 Incorrect handling of certain characters passed to the redirection functionality in Rails can lead to a single-click XSS vulnerability. #1955370 Valid Cross-site Scripting Medium 2023-07-28 – 15 Specially constructed multi-part requests cause multi-second response times; vulnerable to DoS #431561 Valid No weakness recorded Medium 2018-12-05 – 17 Subdomain Takeover at https://new.rubyonrails.org/ #1429148 Valid Access Control High 2022-03-03 – 17 XSS vulnerability in sanitize-method when parsing link's href #328270 Valid Cross-site Scripting Medium 2018-03-22 – 18 ReDoS in Rack::Multipart #1489141 Valid No weakness recorded High 2023-07-28 – 18 Possible DoS in NumberHelpers #2814774 Valid Denial of Service Medium 2026-10-06 – 18 Open Redirect (6.0.0 < rails < 6.0.3.2) #904059 Valid Open Redirect High 2020-12-22 $1,000 19 Content Security Policy is only active for HTML responses but not for image/svg+xml #1327196 Valid Cross-site Scripting – 2023-07-28 – 20 Validation bypass for queries generated for PostgreSQL #394253 Valid No weakness recorded – 2018-11-19 $1,500 21 Rails::HTML::Sanitizer.allowed_uri? returns true for entity-encoded control-character-split javascript: URLs #3601655 Valid No weakness recorded Low 2026-04-18 – 23 Action Text to_markdown: <code>/<pre> content escapes its delimiter, letting a stored body inject arbitrary Markdown #3994016 Valid Cross-site Scripting Medium 2026-09-12 – 23