Read the docs
TI-2013-00263 Aliases CVE-2013-0333GHSA-xgr2-v94m-rc9g

lib/active_support/json/backends/yaml.rb in Ruby on Rails 2.3.x before 2.3.16 and 3.0.x…

Priority HIGH 77CWE-74Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Partial · Partial · Partial
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA, GitHub and Red Hat.

Summary

lib/active_support/json/backends/yaml.rb in Ruby on Rails 2.3.x before 2.3.16 and 3.0.x before 3.0.20 does not properly convert JSON data to YAML data for processing by a YAML parser, which allows remote attackers to execute arbitrary code, conduct SQL injection attacks, or bypass authentication via crafted data that triggers unsafe decoding, a different vulnerability than CVE-2013-0156.

Why it matters now

EPSS 0.95573 99th percentileScored 2026-11-07
Fix Fixed activesupport (RubyGems): 2.3.16, 3.0.20Red Hat: 3 advisories

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—activesupport (RubyGems)2.3.2 to before 2.3.162.3.16Patch availableGHSA-xgr2-v94m-rc9g
—activesupport (RubyGems)3.0.0 to before 3.0.203.0.20Patch availableGHSA-xgr2-v94m-rc9g
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • activesupport (RubyGems) Vendor— Affected 2.3.2 to before 2.3.16 Fixed in 2.3.16 Patch available GHSA-xgr2-v94m-rc9g
  • activesupport (RubyGems) Vendor— Affected 3.0.0 to before 3.0.20 Fixed in 3.0.20 Patch available GHSA-xgr2-v94m-rc9g

CPE configurations NVD · 57

CPEVersionsRoleVendor
cpe:2.3:a:rubyonrails:rails:2.3.0:*:*:*:*:*:*:*2.3.0VulnerableRails
cpe:2.3:a:rubyonrails:rails:2.3.1:*:*:*:*:*:*:*2.3.1VulnerableRails
cpe:2.3:a:rubyonrails:rails:2.3.2:*:*:*:*:*:*:*2.3.2VulnerableRails
cpe:2.3:a:rubyonrails:rails:2.3.3:*:*:*:*:*:*:*2.3.3VulnerableRails
cpe:2.3:a:rubyonrails:rails:2.3.4:*:*:*:*:*:*:*2.3.4VulnerableRails
cpe:2.3:a:rubyonrails:rails:2.3.9:*:*:*:*:*:*:*2.3.9VulnerableRails
cpe:2.3:a:rubyonrails:rails:2.3.10:*:*:*:*:*:*:*2.3.10VulnerableRails
cpe:2.3:a:rubyonrails:rails:2.3.11:*:*:*:*:*:*:*2.3.11VulnerableRails
cpe:2.3:a:rubyonrails:rails:2.3.12:*:*:*:*:*:*:*2.3.12VulnerableRails
cpe:2.3:a:rubyonrails:rails:2.3.13:*:*:*:*:*:*:*2.3.13VulnerableRails
  • cpe:2.3:a:rubyonrails:rails:2.3.0:*:*:*:*:*:*:* Versions 2.3.0 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:2.3.1:*:*:*:*:*:*:* Versions 2.3.1 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:2.3.2:*:*:*:*:*:*:* Versions 2.3.2 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:2.3.3:*:*:*:*:*:*:* Versions 2.3.3 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:2.3.4:*:*:*:*:*:*:* Versions 2.3.4 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:2.3.9:*:*:*:*:*:*:* Versions 2.3.9 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:2.3.10:*:*:*:*:*:*:* Versions 2.3.10 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:2.3.11:*:*:*:*:*:*:* Versions 2.3.11 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:2.3.12:*:*:*:*:*:*:* Versions 2.3.12 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:2.3.13:*:*:*:*:*:*:* Versions 2.3.13 Vulnerable ·Rails
Show 47 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:rubyonrails:rails:2.3.14:*:*:*:*:*:*:*2.3.14VulnerableRails
cpe:2.3:a:rubyonrails:rails:2.3.15:*:*:*:*:*:*:*2.3.15VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.0.0:*:*:*:*:*:*:*3.0.0VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.0.0:beta:*:*:*:*:*:*3.0.0 betaVulnerableRails
cpe:2.3:a:rubyonrails:rails:3.0.0:beta2:*:*:*:*:*:*3.0.0 beta2VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.0.0:beta3:*:*:*:*:*:*3.0.0 beta3VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.0.0:beta4:*:*:*:*:*:*3.0.0 beta4VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.0.0:rc:*:*:*:*:*:*3.0.0 rcVulnerableRails
cpe:2.3:a:rubyonrails:rails:3.0.0:rc2:*:*:*:*:*:*3.0.0 rc2VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.0.1:*:*:*:*:*:*:*3.0.1VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.0.1:pre:*:*:*:*:*:*3.0.1 preVulnerableRails
cpe:2.3:a:rubyonrails:rails:3.0.2:*:*:*:*:*:*:*3.0.2VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.0.2:pre:*:*:*:*:*:*3.0.2 preVulnerableRails
cpe:2.3:a:rubyonrails:rails:3.0.3:*:*:*:*:*:*:*3.0.3VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.0.4:rc1:*:*:*:*:*:*3.0.4 rc1VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.0.5:*:*:*:*:*:*:*3.0.5VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.0.5:rc1:*:*:*:*:*:*3.0.5 rc1VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.0.6:*:*:*:*:*:*:*3.0.6VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.0.6:rc1:*:*:*:*:*:*3.0.6 rc1VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.0.6:rc2:*:*:*:*:*:*3.0.6 rc2VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.0.7:*:*:*:*:*:*:*3.0.7VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.0.7:rc1:*:*:*:*:*:*3.0.7 rc1VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.0.7:rc2:*:*:*:*:*:*3.0.7 rc2VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.0.8:*:*:*:*:*:*:*3.0.8VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.0.8:rc1:*:*:*:*:*:*3.0.8 rc1VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.0.8:rc2:*:*:*:*:*:*3.0.8 rc2VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.0.8:rc3:*:*:*:*:*:*3.0.8 rc3VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.0.8:rc4:*:*:*:*:*:*3.0.8 rc4VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.0.9:*:*:*:*:*:*:*3.0.9VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.0.9:rc1:*:*:*:*:*:*3.0.9 rc1VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.0.9:rc2:*:*:*:*:*:*3.0.9 rc2VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.0.9:rc3:*:*:*:*:*:*3.0.9 rc3VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.0.9:rc4:*:*:*:*:*:*3.0.9 rc4VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.0.9:rc5:*:*:*:*:*:*3.0.9 rc5VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.0.10:*:*:*:*:*:*:*3.0.10VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.0.10:rc1:*:*:*:*:*:*3.0.10 rc1VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.0.11:*:*:*:*:*:*:*3.0.11VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.0.12:*:*:*:*:*:*:*3.0.12VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.0.12:rc1:*:*:*:*:*:*3.0.12 rc1VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.0.13:*:*:*:*:*:*:*3.0.13VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.0.13:rc1:*:*:*:*:*:*3.0.13 rc1VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.0.14:*:*:*:*:*:*:*3.0.14VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.0.16:*:*:*:*:*:*:*3.0.16VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.0.17:*:*:*:*:*:*:*3.0.17VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.0.18:*:*:*:*:*:*:*3.0.18VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.0.19:*:*:*:*:*:*:*3.0.19VulnerableRails
cpe:2.3:a:rubyonrails:ruby_on_rails:3.0.4:*:*:*:*:*:*:*3.0.4VulnerableRails
  • cpe:2.3:a:rubyonrails:rails:2.3.14:*:*:*:*:*:*:* Versions 2.3.14 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:2.3.15:*:*:*:*:*:*:* Versions 2.3.15 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.0.0:*:*:*:*:*:*:* Versions 3.0.0 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.0.0:beta:*:*:*:*:*:* Versions 3.0.0 beta Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.0.0:beta2:*:*:*:*:*:* Versions 3.0.0 beta2 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.0.0:beta3:*:*:*:*:*:* Versions 3.0.0 beta3 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.0.0:beta4:*:*:*:*:*:* Versions 3.0.0 beta4 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.0.0:rc:*:*:*:*:*:* Versions 3.0.0 rc Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.0.0:rc2:*:*:*:*:*:* Versions 3.0.0 rc2 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.0.1:*:*:*:*:*:*:* Versions 3.0.1 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.0.1:pre:*:*:*:*:*:* Versions 3.0.1 pre Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.0.2:*:*:*:*:*:*:* Versions 3.0.2 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.0.2:pre:*:*:*:*:*:* Versions 3.0.2 pre Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.0.3:*:*:*:*:*:*:* Versions 3.0.3 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.0.4:rc1:*:*:*:*:*:* Versions 3.0.4 rc1 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.0.5:*:*:*:*:*:*:* Versions 3.0.5 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.0.5:rc1:*:*:*:*:*:* Versions 3.0.5 rc1 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.0.6:*:*:*:*:*:*:* Versions 3.0.6 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.0.6:rc1:*:*:*:*:*:* Versions 3.0.6 rc1 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.0.6:rc2:*:*:*:*:*:* Versions 3.0.6 rc2 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.0.7:*:*:*:*:*:*:* Versions 3.0.7 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.0.7:rc1:*:*:*:*:*:* Versions 3.0.7 rc1 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.0.7:rc2:*:*:*:*:*:* Versions 3.0.7 rc2 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.0.8:*:*:*:*:*:*:* Versions 3.0.8 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.0.8:rc1:*:*:*:*:*:* Versions 3.0.8 rc1 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.0.8:rc2:*:*:*:*:*:* Versions 3.0.8 rc2 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.0.8:rc3:*:*:*:*:*:* Versions 3.0.8 rc3 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.0.8:rc4:*:*:*:*:*:* Versions 3.0.8 rc4 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.0.9:*:*:*:*:*:*:* Versions 3.0.9 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.0.9:rc1:*:*:*:*:*:* Versions 3.0.9 rc1 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.0.9:rc2:*:*:*:*:*:* Versions 3.0.9 rc2 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.0.9:rc3:*:*:*:*:*:* Versions 3.0.9 rc3 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.0.9:rc4:*:*:*:*:*:* Versions 3.0.9 rc4 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.0.9:rc5:*:*:*:*:*:* Versions 3.0.9 rc5 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.0.10:*:*:*:*:*:*:* Versions 3.0.10 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.0.10:rc1:*:*:*:*:*:* Versions 3.0.10 rc1 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.0.11:*:*:*:*:*:*:* Versions 3.0.11 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.0.12:*:*:*:*:*:*:* Versions 3.0.12 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.0.12:rc1:*:*:*:*:*:* Versions 3.0.12 rc1 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.0.13:*:*:*:*:*:*:* Versions 3.0.13 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.0.13:rc1:*:*:*:*:*:* Versions 3.0.13 rc1 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.0.14:*:*:*:*:*:*:* Versions 3.0.14 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.0.16:*:*:*:*:*:*:* Versions 3.0.16 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.0.17:*:*:*:*:*:*:* Versions 3.0.17 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.0.18:*:*:*:*:*:*:* Versions 3.0.18 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.0.19:*:*:*:*:*:*:* Versions 3.0.19 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:ruby_on_rails:3.0.4:*:*:*:*:*:*:* Versions 3.0.4 Vulnerable ·Rails

Remediation

  • Fix · GHSA-xgr2-v94m-rc9g activesupport (RubyGems) Fixed in 2.3.16 Advisory →
  • Fix · GHSA-xgr2-v94m-rc9g activesupport (RubyGems) Fixed in 3.0.20 Advisory →

Red Hat 3 advisories

  • RHSA-2013:0203 Released 2013-01-29 · Red Hat rating Critical
    rubygem-activesupport security update
    • CloudForms Cloud Engine for RHEL 6 Server rubygem-activesupport-1:3.0.10-9.el6cf
    • CloudForms System Engine for RHEL 6 Server katello-1.1.12.1-1.el6cf, katello-all-1.1.12.1-1.el6cf, katello-api-docs-1.1.12.1-1.el6cf +4
  • RHSA-2013:0202 Released 2013-01-28 · Red Hat rating Critical
    rubygem-activesupport security update
    • Red Hat OpenShift Enterprise Infrastructure rubygem-activesupport-1:3.0.13-4.el6op
    • Red Hat OpenShift Enterprise Node rubygem-activesupport-1:3.0.13-4.el6op
  • RHSA-2013:0201 Released 2013-01-28 · Red Hat rating Critical
    rubygem-activesupport security update
    • Red Hat Subscription Asset Manager for RHEL 6 Server rubygem-activesupport-1:3.0.10-7.el6cf

Vendor assessments

Red Hat

Red Hat rating: Critical. Red Hat's page for this CVE →

ProductStatusPlan or fix
CloudForms Cloud Engine for RHEL 6 ServerFixed RHSA-2013:0203
CloudForms System Engine for RHEL 6 ServerFixed RHSA-2013:0203
Red Hat OpenShift Enterprise InfrastructureFixed RHSA-2013:0202
Red Hat OpenShift Enterprise NodeFixed RHSA-2013:0202
Red Hat Subscription Asset Manager for RHEL 6 ServerFixed RHSA-2013:0201
Not affected: 1 product
  • OpenShift Enterprise 1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2013-0333
  2. 2026-10-03 Alias added: GHSA-xgr2-v94m-rc9g

References

Advisory 10

Other 11

  • TI-2014-00124 Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the… KEVCVSS 3.1HIGH 7.5
  • TI-2019-03828 Path traversal in Rails https://github.com/rails/rails KEVCVSS 3.1HIGH 7.5
  • TI-2016-00672 Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x… KEVCVSS 3.1HIGH 7.5
  • TI-2019-03830 Command injection in Rails https://github.com/rails/rails CVSS 3.1CRITICAL 9.8
  • TI-2020-06581 Code injection in https://github.com/rails/rails CVSS 3.1HIGH 8.8
  • TI-2013-00091 active_support/core_ext/hash/conversions.rb in Ruby on Rails before 2.3.15, 3.0.x before… CVSS 2.0HIGH 7.5
See all 117 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences