Data Injection Affecting activerecord package, versions >=2.3.2, <4.0.0.beta1

  • Attack Complexity


Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • snyk-id


  • published

    25 Jun 2021

  • disclosed

    21 Apr 2013

  • credit


How to fix?

Upgrade activerecord to version 4.0.0.beta1 or higher.


activerecord is a library for databases on Rails.

Affected versions of this package are vulnerable to Data Injection. It does not ensure that the declared data type of a database column is used during comparisons of input values to stored values in that column, which makes it easier for remote attackers to conduct data-type injection attacks against Ruby on Rails applications via a crafted value, as demonstrated by unintended interaction between the "typed XML" feature and a MySQL database.