---
title: "Rails activerecord vulnerabilities and CVEs"
url: https://radicalnotion.ai/vendor/rails/activerecord
type: product
description: "Rails activerecord has 15 published CVEs, 0 in CISA KEV and 8 with public exploits."
updated: 2025-08-13
source: RadicalNotion.AI
license: CC BY-NC 4.0 (https://creativecommons.org/licenses/by-nc/4.0/)
---

# Rails activerecord vulnerabilities

Vendor: [Rails](https://radicalnotion.ai/vendor/rails)

- **Published CVEs:** 15
- **In CISA KEV:** 0
- **With a public exploit:** 8
- **With a patch:** 15
- **Average CVSS:** 7.8
- **First CVE:** 2008-09-30
- **Latest CVE:** 2025-08-13
- **Ecosystems:** gem

## Severity breakdown

| Severity | CVEs |
| --- | --- |
| Critical | 3 |
| High | 9 |
| Medium | 3 |
| Low | 0 |
| Unscored | 0 |

## Most common weakness types

| CWE | Name | CVEs |
| --- | --- | --- |
| [CWE-89](https://radicalnotion.ai/cwe/cwe-89) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | 8 |
| [CWE-20](https://radicalnotion.ai/cwe/cwe-20) | Improper Input Validation | 2 |
| [CWE-400](https://radicalnotion.ai/cwe/cwe-400) | Uncontrolled Resource Consumption | 2 |
| [CWE-150](https://radicalnotion.ai/cwe/cwe-150) | Improper Neutralization of Escape, Meta, or Control Sequences | 1 |
| [CWE-502](https://radicalnotion.ai/cwe/cwe-502) | Deserialization of Untrusted Data | 1 |

## CVEs by year

| Year | CVEs published |
| --- | --- |
| 2014 | 2 |
| 2015 | 0 |
| 2016 | 0 |
| 2017 | 0 |
| 2018 | 0 |
| 2019 | 0 |
| 2020 | 0 |
| 2021 | 1 |
| 2022 | 1 |
| 2023 | 2 |
| 2024 | 0 |
| 2025 | 1 |

## Affected versions (top 24 of 67)

| Version | Kind | CVEs |
| --- | --- | --- |
| \< 2.3.15 | range | 2 |
| 7.0.0 \<= v \< 7.0.4.1 | range | 2 |
| \< 2.1.1 | range | 1 |
| \< 2.3.17 | range | 1 |
| \< 4.2.0 | range | 1 |
| \< 5.2.8.1 | range | 1 |
| \< 6.1.7.1 | range | 1 |
| \< 7.1.5.2 | range | 1 |
| 2.0.0 \<= v \< 2.3.13 | range | 1 |
| 2.0.0 \<= v \< 3.2.19 | range | 1 |
| 2.3.9 \<= v \< 2.3.10 | range | 1 |
| 3.0.0 \<= v \< 3.0.1 | range | 1 |
| 2.3.15 | patched | 2 |
| 6.1.7.1 | patched | 2 |
| 7.0.4.1 | patched | 2 |
| 2.1.1 | patched | 1 |
| 2.3.10 | patched | 1 |
| 2.3.13 | patched | 1 |
| 2.3.17 | patched | 1 |
| 3.0.1 | patched | 1 |
| 3.0.10 | patched | 1 |
| 3.0.14 | patched | 1 |
| 3.0.18 | patched | 1 |
| 3.0.4 | patched | 1 |

## CVEs

| CVE | Title | Severity | CVSS | CISA KEV | Public exploit | Patch |
| --- | --- | --- | --- | --- | --- | --- |
| CVE-2025-55193 | Active Record logging vulnerable to ANSI escape injection | medium | 5.3 | No | No | Yes |
| CVE-2023-22794 | SQL Injection Vulnerability via ActiveRecord comments | high | 8.8 | No | Yes | Yes |
| CVE-2022-44566 | Denial of Service Vulnerability in ActiveRecord's PostgreSQL adapter | high | 7.5 | No | Yes | Yes |
| CVE-2022-32224 | Active Record RCE bug with Serialized Columns | critical | 9.8 | No | Yes | Yes |
| CVE-2021-22880 | Active Record subject to Regular Expression Denial-of-Service (ReDoS) | high | 7.5 | No | Yes | Yes |
| CVE-2014-3482 | SQL Injection in Active Record | high | 7.5 | No | No | Yes |
| CVE-2014-0080 | Array data injection vulnerability in activerecord | medium | 6.8 | No | No | Yes |
| CVE-2013-3221 | Active Record component in Ruby on Rails has a data-type injection vulnerability | critical | 9.3 | No | Yes | Yes |
| CVE-2013-0277 | Active Record contains deserialization of arbitrary YAML | critical | 10.0 | No | No | Yes |
| CVE-2012-6496 | Active Record contains SQL Injection | high | 7.5 | No | Yes | Yes |
| CVE-2012-2695 | activerecord vulnerable to SQL Injection | high | 7.5 | No | Yes | Yes |
| CVE-2011-2930 | activerecord vulnerable to SQL Injection | high | 7.5 | No | No | Yes |
| CVE-2011-0448 | activerecord vulnerable to SQL Injection | high | 7.5 | No | No | Yes |
| CVE-2010-3933 | Rails activerecord gem has Improper Input Validation vulnerability | medium | 6.4 | No | No | Yes |
| CVE-2008-4094 | Rails ActiveRecord gem vulnerable to SQL injection | high | 7.5 | No | Yes | Yes |

## Frequently asked questions

### How many CVEs does Rails activerecord have?

Rails activerecord has 15 published CVE records since 2008.

### How many Rails activerecord CVEs are in CISA KEV?

None of Rails activerecord's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

### Are there public exploits for Rails activerecord vulnerabilities?

Yes — 8 of Rails activerecord's CVEs have a known public exploit.

### Which versions of Rails activerecord are affected?

67 distinct Rails activerecord versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.

### What are the most common weakness types in Rails activerecord CVEs?

Rails activerecord's CVEs most often map to these CWE weakness types: CWE-89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')), CWE-20 (Improper Input Validation), CWE-400 (Uncontrolled Resource Consumption), CWE-150 (Improper Neutralization of Escape, Meta, or Control Sequences).

### How many critical Rails activerecord vulnerabilities are there?

Rails activerecord has 3 critical and 9 high-severity CVEs.

### What is the average severity of Rails activerecord CVEs?

The average CVSS base score across Rails activerecord's scored CVEs is 7.8.

## Other products from this vendor

- [rails](https://radicalnotion.ai/vendor/rails/rails) (110 CVEs)
- [actionpack](https://radicalnotion.ai/vendor/rails/actionpack) (46 CVEs)
- [rails-html-sanitizer](https://radicalnotion.ai/vendor/rails/rails-html-sanitizer) (15 CVEs)
- [ActiveSupport](https://radicalnotion.ai/vendor/rails/activesupport) (13 CVEs)
- [activestorage](https://radicalnotion.ai/vendor/rails/activestorage) (9 CVEs)
- [actionview](https://radicalnotion.ai/vendor/rails/actionview) (8 CVEs)
- [https://github.com/rails/rails](https://radicalnotion.ai/vendor/rails/https-github-com-rails-rails) (3 CVEs)
- [actionmailer](https://radicalnotion.ai/vendor/rails/actionmailer) (2 CVEs)

---

Source: [RadicalNotion.AI](https://radicalnotion.ai/vendor/rails/activerecord). Licensed CC BY-NC 4.0; attribute RadicalNotion.AI and link the source page when you reuse this data.