CVE-2023-22794

CVE-2023-22794 is a high-severity SQL injection vulnerability affecting ActiveRecord versions prior to 6.0.6.1, 6.1.7.1, and 7.0.4.1. Malicious user input passed to the annotate or optimizer_hints query methods, or via the QueryLogs interface, can bypass sanitization and inject SQL commands outside of intended comments. This vulnerability carries a CVSS score of 8.8, indicating a high potential for complete compromise of confidentiality, integrity, and availability with low attack complexity and no user interaction required. While no active exploits, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion have been observed, the high FAUCET Risk Score of 80/100 suggests a significant risk.