rails (RubyGems)
Advisories
14
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 7.1.3.1 or later clears every advisory below that has a fix.
Upgrade commands
bundler
bundle update rails # Gemfile: gem "rails", ">= 7.1.3.1"Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-9822-6m93-xqf4 Rails has possible XSS Vulnerability in Action Controller |
Medium EPSS 1.03% |
>= 7.0.0, < 7.0.8.1 | 7.0.8.1 |
| GHSA-9822-6m93-xqf4 Rails has possible XSS Vulnerability in Action Controller |
Medium EPSS 1.03% |
>= 7.1.0, < 7.1.3.1 | 7.1.3.1 |
| GHSA-rxq3-gm4p-5fj4 rails vulnerable to improper authentication |
Critical EPSS 3.38% |
< 2.3.3 | 2.3.3 |
| GHSA-jmgf-p46x-982h rails is vulnerable to CRLF injection |
Medium EPSS 1.53% |
< 2.0.5 | 2.0.5 |
| GHSA-rvpq-5xqx-pfpp Ruby on Rails vulnerable to code injection |
High EPSS 2.33% |
>= 1.1.0, < 1.1.6 | 1.1.6 |
| GHSA-jwhv-rgqc-fqj5 Session fixation vulnerability in Rails |
Medium EPSS 3.58% |
< 1.2.4 | 1.2.4 |
| GHSA-9p3v-wf2w-v29c Moderate severity vulnerability that affects rails |
Medium EPSS 3.02% |
< 2.2.2 | 2.2.2 |
| GHSA-9p3v-wf2w-v29c Moderate severity vulnerability that affects rails |
Medium EPSS 3.02% |
>= 2.3.0, < 2.3.5 | 2.3.5 |
| GHSA-9wrq-xvmp-xjc8 Rails Denial of Service vulnerability |
High EPSS 3.12% |
>= 1.1.0, < 1.1.6 | 1.1.6 |
| GHSA-gm25-fpmr-43fj Moderate severity vulnerability that affects rails |
Medium EPSS 3.68% |
< 1.2.5 | 1.2.5 |
| GHSA-fjfg-q662-gm6j Moderate severity vulnerability that affects rails |
Medium EPSS 3.97% |
< 1.2.4 | 1.2.4 |
| GHSA-p4c6-77gc-694x session fixation protection mechanism in cgi_process.rb in Rails |
Medium EPSS 2.51% |
< 1.2.6 | 1.2.6 |
| GHSA-m46p-ggm5-5j83 Rails vulnerable to Cross-site Scripting |
Medium EPSS 4.03% |
>= 4.0.0, < 4.0.3 | 4.0.3 |
| GHSA-m46p-ggm5-5j83 Rails vulnerable to Cross-site Scripting |
Medium EPSS 4.03% |
>= 3.0.0, < 3.2.17 | 3.2.17 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor