CVE-2019-5420

CVE-2019-5420 is a critical remote code execution vulnerability affecting Ruby on Rails versions prior to 5.2.2.1 and 6.0.0.beta3 when running in development mode. An attacker can guess the automatically generated secret token, which, when combined with other Rails internals, leads to full remote code execution. This vulnerability carries a CVSS score of 9.8 (Critical) due to its network-based attack vector, low attack complexity, and complete compromise of confidentiality, integrity, and availability. While not listed in CISA's KEV catalog, exploit code is publicly available via a Metasploit module, though there is no evidence of active exploitation or significant community discussion.