Ruby on Rails is a widely adopted web-application framework that underpins a substantial portion of the internet's public-facing applications, making its security posture relevant across an enormous downstream user base despite a narrow product count. Vulnerabilities affecting the framework and its core components such as ActionPack and HTML sanitizers skew toward moderate severity and cluster around input-handling and output-encoding weaknesses including cross-site scripting, SQL injection, and improper input validation—attack surfaces inherent to a web-facing request-processing architecture. The framework's vulnerabilities frequently acquire public proof-of-concept code, reflecting both the transparency of open-source development and the appeal of web-application frameworks to security researchers. Defenders deploying Rails applications should prioritize the framework's security releases and treat input-sanitization and parameterized-query practices as foundational controls; live exploitation activity and severity counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Rubyonrails over time
Signals from CVEs in this vendor scope (144 CVEs).
144 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2019-5418HIGH There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where specially crafted accept headers can cause contents of arbitrar | Mar 27, 2019 | 7.5 | 99 | YES | YES |
CVE-2016-0752HIGH Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows remote | Feb 16, 2016 | 7.5 | 97 | YES | YES |
CVE-2019-5420CRITICAL A remote code execution vulnerability in development mode Rails <5.2.2.1, <6.0.0.beta3 can allow an attacker to guess the automatically generated development mode secret token. Thi | Mar 27, 2019 | 9.8 | 90 | NO | YES |
CVE-2013-0156HIGH active_support/core_ext/hash/conversions.rb in Ruby on Rails before 2.3.15, 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly restrict casts of st | Jan 13, 2013 | 7.5 | 89 | NO | YES |
CVE-2013-0333HIGH lib/active_support/json/backends/yaml.rb in Ruby on Rails 2.3.x before 2.3.16 and 3.0.x before 3.0.20 does not properly convert JSON data to YAML data for processing by a YAML pars | Jan 30, 2013 | 7.5 | 88 | NO | YES |
CVE-2016-2098HIGH Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary Ruby code by leveraging an application's un | Apr 7, 2016 | 7.3 | 84 | NO | YES |
CVE-2014-0130HIGH Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails before 3.2.18, 4.0.x before 4.0.5, and 4.1.x | May 7, 2014 | 7.5 | 83 | YES | NO |
CVE-2020-8163HIGH The is a code injection vulnerability in versions of Rails prior to 5.0.1 that wouldallow an attacker who controlled the `locals` argument of a `render` call to perform a RCE. | Jul 2, 2020 | 8.8 | 82 | NO | YES |
CVE-2021-22881MEDIUM The Host Authorization middleware in Action Pack before 6.1.2.1, 6.0.3.5 suffers from an open redirect vulnerability. Specially crafted `Host` headers in combination with certain " | Feb 11, 2021 | 6.1 | 78 | NO | YES |
CVE-2015-3224MEDIUM request.rb in Web Console before 2.1.3, as used with Ruby on Rails 3.x and 4.x, does not properly restrict the use of X-Forwarded-For headers in determining a client's IP address, | Jul 26, 2015 | 4.3 | 69 | NO | YES |
Signals from CVEs in this vendor scope (144 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Rubyonrails.
Media articles that mention a CVE ID that affects a product developed by Rubyonrails — matched by CVE ID, not by vendor name.