CVSS: 9.1EPSS: 0%CPEs: 3EXPL: 0CVE-2026-33202 – Rails Active Storage has possible glob injection in its DiskService
https://notcve.org/view.php?id=CVE-2026-33202
23 Mar 2026 — Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Storage's `DiskService#delete_prefixed` passes blob keys directly to `Dir.glob` without escaping glob metacharacters. If a blob key contains attacker-controlled input or custom-generated keys with glob metacharacters, it may be possible to delete unintended files from the storage directory. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch. Active Storage permite a ... • https://github.com/rails/rails/commit/8c9676b803820110548cdb7523800db43bc6874c • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •
CVSS: 9.8EPSS: 0%CPEs: 3EXPL: 0CVE-2026-33195 – Rails Active Storage has possible Path Traversal in DiskService
https://notcve.org/view.php?id=CVE-2026-33195
23 Mar 2026 — Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Storage's `DiskService#path_for` does not validate that the resolved filesystem path remains within the storage root directory. If a blob key containing path traversal sequences (e.g. `../`) is used, it could allow reading, writing, or deleting arbitrary files on the server. Blob keys are expected to be trusted strings, but some applications could be passing user input a... • https://github.com/rails/rails/commit/4933c1e3b8c1bb04925d60347be9f69270392f2c • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2026-33176 – Rails Active Support has a possible DoS vulnerability in its number helpers
https://notcve.org/view.php?id=CVE-2026-33176
23 Mar 2026 — Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Support number helpers accept strings containing scientific notation (e.g. `1e10000`), which `BigDecimal` expands into extremely large decimal representations. This can cause excessive memory allocation and CPU consumption when the expanded number is formatted, possibly resulting in a DoS vulnerability. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 co... • https://github.com/rails/rails/commit/19dbab51ca086a657bb86458042bc44314916bcb • CWE-400: Uncontrolled Resource Consumption CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2026-33174 – Rails Active Storage has a possible DoS vulnerability when in proxy mode via Range requests
https://notcve.org/view.php?id=CVE-2026-33174
23 Mar 2026 — Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, when serving files through Active Storage's proxy delivery mode, the proxy controller loads the entire requested byte range into memory before sending it. A request with a large or unbounded Range header (e.g. `bytes=0-`) could cause the server to allocate memory proportional to the file size, possibly resulting in a DoS vulnerability through memory exhaustion. Versions 8.1.2.1... • https://github.com/rails/rails/commit/2cd933c366b777f873d4d590127da2f4a25e4ba5 • CWE-789: Memory Allocation with Excessive Size Value •
CVSS: 5.3EPSS: 0%CPEs: 3EXPL: 0CVE-2026-33173 – Rails Active Storage has possible content type bypass via metadata in direct uploads
https://notcve.org/view.php?id=CVE-2026-33173
23 Mar 2026 — Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, `DirectUploadsController` accepts arbitrary metadata from the client and persists it on the blob. Because internal flags like `identified` and `analyzed` are stored in the same metadata hash, a direct-upload client can set these flags to skip MIME detection and analysis. This allows an attacker to upload arbitrary content while claiming a safe `content_type`, bypassing any vali... • https://github.com/rails/rails/commit/707c0f1f41f067fdf96d54e99d43b28dfaae7e53 • CWE-925: Improper Verification of Intent by Broadcast Receiver •
CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 0CVE-2026-33170 – Rails Active Support has a possible XSS vulnerability in SafeBuffer#%
https://notcve.org/view.php?id=CVE-2026-33170
23 Mar 2026 — Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, `SafeBuffer#%` does not propagate the `@html_unsafe` flag to the newly created buffer. If a `SafeBuffer` is mutated in place (e.g. via `gsub!`) and then formatted with `%` using untrusted arguments, the result incorrectly reports `html_safe? == true`, bypassing ERB auto-escaping and possibly leading to XSS. • https://github.com/rails/rails/commit/50d732af3b7c8aaf63cbcca0becbc00279b215b7 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.9EPSS: 0%CPEs: 3EXPL: 0CVE-2026-33169 – Rails Active Support has a possible ReDoS vulnerability in number_to_delimited
https://notcve.org/view.php?id=CVE-2026-33169
23 Mar 2026 — Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. `NumberToDelimitedConverter` uses a lookahead-based regular expression with `gsub!` to insert thousands delimiters. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, the interaction between the repeated lookahead group and `gsub!` can produce quadratic time complexity on long digit strings. • https://github.com/rails/rails/commit/29154f1097da13d48fdb3200760b3e3da66dcb11 • CWE-400: Uncontrolled Resource Consumption CWE-1333: Inefficient Regular Expression Complexity •
CVSS: 9.8EPSS: 0%CPEs: 3EXPL: 0CVE-2025-55193 – Active Record logging vulnerable to ANSI escape injection
https://notcve.org/view.php?id=CVE-2025-55193
13 Aug 2025 — Active Record connects classes to relational database tables. Prior to versions 7.1.5.2, 7.2.2.2, and 8.0.2.1, the ID passed to find or similar methods may be logged without escaping. If this is directly to the terminal it may include unescaped ANSI sequences. This issue has been patched in versions 7.1.5.2, 7.2.2.2, and 8.0.2.1. Active Record conecta clases con tablas de bases de datos relacionales. • https://github.com/rails/rails/commit/3beef20013736fd52c5dcfdf061f7999ba318290 • CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2024-47889 – Action Mailer has possible ReDoS vulnerability in block_format
https://notcve.org/view.php?id=CVE-2024-47889
16 Oct 2024 — Action Mailer is a framework for designing email service layers. Starting in version 3.0.0 and prior to versions 6.1.7.9, 7.0.8.5, 7.1.4.1, and 7.2.1.1, there is a possible ReDoS vulnerability in the block_format helper in Action Mailer. Carefully crafted text can cause the block_format helper to take an unexpected amount of time, possibly resulting in a DoS vulnerability. All users running an affected release should either upgrade to versions 6.1.7.9, 7.0.8.5, 7.1.4.1, or 7.2.1.1 or apply the relevant patc... • https://github.com/rails/rails/commit/0e5694f4d32544532d2301a9b4084eacb6986e94 • CWE-1333: Inefficient Regular Expression Complexity •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2024-47887 – Action Controller has possible ReDoS vulnerability in HTTP Token authentication
https://notcve.org/view.php?id=CVE-2024-47887
16 Oct 2024 — Action Pack is a framework for handling and responding to web requests. Starting in version 4.0.0 and prior to versions 6.1.7.9, 7.0.8.5, 7.1.4.1, and 7.2.1.1, there is a possible ReDoS vulnerability in Action Controller's HTTP Token authentication. For applications using HTTP Token authentication via `authenticate_or_request_with_http_token` or similar, a carefully crafted header may cause header parsing to take an unexpected amount of time, possibly resulting in a DoS vulnerability. All users running an a... • https://github.com/rails/rails/commit/56b2fc3302836405b496e196a8d5fc0195e55049 • CWE-1333: Inefficient Regular Expression Complexity •