Read the docs

Rails

Records164All Threatist records
Exploited (KEV)3In CISA KEV
CVSS critical10CVSS 9.0–10.0
CVSS high43CVSS 7.0–8.9

Exploited now

Rails records in CISA KEV
TI-2019-03828 Rails Ruby on Rails Path Traversal Vulnerability Priority CRITICAL 90KEV 2025-07-07TI-2014-00124 Ruby on Rails Directory Traversal Vulnerability Priority CRITICAL 92KEV 2022-03-25TI-2016-00672 Ruby on Rails Directory Traversal Vulnerability Priority CRITICAL 90KEV 2022-03-25

Components

Products in the NVD configurations · select one to filter the records
Rails 118 records CRITICAL Ruby On Rails 49 records HIGH Rails Html Sanitizers 10 records MEDIUM Html Sanitizer 4 records LOW Actionpack 2 records LOW Actionpack Page-caching 2 records MEDIUM Actionview 1 record LOW Active Record Session Store 1 record LOW

Records

2 records in Actionpack Page-caching · all components

TI-2020-06577 CVE-2020-8159 · GHSA-mg5p-95m9-rmfp

Path traversal in https://github.com/rails/actionpack-page_caching

Priority MEDIUM 50

There is a vulnerability in actionpack_page-caching gem < v1.2.1 that allows an attacker to write arbitrary files to a web server, potentially resulting in remote code execution if the attacker can write unescaped ERB to…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0538 Published 2020-05-12 Fixed in 1.2.1 CWE-22
TI-2021-05746 CVE-2021-22885 · GHSA-hjg4-8q5f-x6fm

Information disclosure through error messages in https://github.com/rails/rails

Priority MEDIUM 40

A possible information disclosure / unintended method execution vulnerability in Action Pack >= 2.0.0 when using the `redirect_to` or `polymorphic_url`helper with untrusted user input.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0405 Published 2021-05-27 Partial fix · 6.0.3.7, 6.1.3.2 +2 CWE-209
Open these records in search →