CVE-2016-2098

CVE-2016-2098 is a critical remote code execution vulnerability affecting Action Pack in Ruby on Rails versions before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2. This flaw allows attackers to execute arbitrary Ruby code by exploiting an application's unrestricted use of the render method. With a CVSS score of 7.3 (HIGH), it presents a low-complexity, network-based attack vector leading to potential compromise of confidentiality, integrity, and availability. While not listed in CISA's KEV catalog, exploit modules are publicly available, including a Metasploit module, and it has garnered significant community discussion and media coverage, indicating a high likelihood of exploitation.