How many Rails https://github.com/rails/rails CVEs are in CISA KEV?

1 of Rails https://github.com/rails/rails's CVEs is listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline.

Which versions of Rails https://github.com/rails/rails are affected?

5 distinct Rails https://github.com/rails/rails versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.

What are the most common weakness types in Rails https://github.com/rails/rails CVEs?

Rails https://github.com/rails/rails's CVEs most often map to these CWE weakness types: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')), CWE-400 (Uncontrolled Resource Consumption), CWE-77 (Improper Neutralization of Special Elements used in a Command ('Command Injection')).

How many critical Rails https://github.com/rails/rails vulnerabilities are there?

Rails https://github.com/rails/rails has 1 critical and 2 high-severity CVEs.

What is the average severity of Rails https://github.com/rails/rails CVEs?

The average CVSS base score across Rails https://github.com/rails/rails's scored CVEs is 8.7.

Rails https://github.com/rails/rails Vulnerabilities: CVEs, CISA KEV & Security Advisories

Name: Rails https://github.com/rails/rails vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

RadicalNotion.AI

Overview

Rails https://github.com/rails/rails has 3 published CVE records since 2019, of which 1 is in CISA's Known Exploited Vulnerabilities catalog and 3 have a known public exploit. The average CVSS base score across scored CVEs is 8.7.

Severity and exploitation

How the CVSS severity of Rails https://github.com/rails/rails's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical1

High2

Medium0

Low0

In CISA’s Known Exploited Vulnerabilities catalog

One of Rails https://github.com/rails/rails's CVEs is confirmed exploited in the wild.

Public exploits

3 of Rails https://github.com/rails/rails's CVEs have a known public exploit available.

Affected versions and CVEs

Browse every Rails https://github.com/rails/rails version named in a CVE, then pick one to see only the CVEs that affect it.

Specific versions

5.2.2.13 CVEs
4.2.11.12 CVEs
5.0.7.22 CVEs
5.1.6.22 CVEs
6.0.0.beta31 CVE

Find a version

3 CVEs

Sort

Use of Insufficiently Random Values in Railties Allows Remote Code Execution
CVE-2019-5420
Public exploit
Patch
CWE-77
Critical · CVSS 9.8
EPSS 89.3% (100th pct)2019-03-27
Denial of Service Vulnerability in Action View
CVE-2019-5419
Public exploit
Patch
CWE-400
High · CVSS 7.5
EPSS 8.4% (95th pct)2019-03-27
Path Traversal in Action View
CVE-2019-5418
CISA KEV
Public exploit
Patch
CWE-22
Added to CISA KEV 2025-07-07
High · CVSS 8.7
EPSS 98.5% (100th pct)2019-03-27

Common weakness types

The CWE weakness categories most often found in Rails https://github.com/rails/rails CVEs. Follow any weakness for its full explanation.

Other Rails products

Browse vulnerabilities for other products by Rails.

rails110 CVEs actionpack46 CVEs activerecord15 CVEs rails-html-sanitizer15 CVEs ActiveSupport13 CVEs activestorage9 CVEs actionview8 CVEs actionmailer

Frequently asked questions

Common questions about Rails https://github.com/rails/rails vulnerabilities.

How many CVEs does Rails https://github.com/rails/rails have?: Rails https://github.com/rails/rails has 3 published CVE records since 2019.
How many Rails https://github.com/rails/rails CVEs are in CISA KEV?: 1 of Rails https://github.com/rails/rails's CVEs is listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline.
Are there public exploits for Rails https://github.com/rails/rails vulnerabilities?: Yes — 3 of Rails https://github.com/rails/rails's CVEs have a known public exploit.
Which versions of Rails https://github.com/rails/rails are affected?: 5 distinct Rails https://github.com/rails/rails versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.
What are the most common weakness types in Rails https://github.com/rails/rails CVEs?: Rails https://github.com/rails/rails's CVEs most often map to these CWE weakness types: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')), CWE-400 (Uncontrolled Resource Consumption), CWE-77 (Improper Neutralization of Special Elements used in a Command ('Command Injection')).
How many critical Rails https://github.com/rails/rails vulnerabilities are there?: Rails https://github.com/rails/rails has 1 critical and 2 high-severity CVEs.
What is the average severity of Rails https://github.com/rails/rails CVEs?: The average CVSS base score across Rails https://github.com/rails/rails's scored CVEs is 8.7.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track Rails https://github.com/rails/rails vulnerabilities

Get an alert for each new Rails https://github.com/rails/rails CVE, with AI-written analysis and remediation steps.

Create an account See pricing