SQL Injection Affecting activity_notification package, versions <2.7.0
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-RUBY-ACTIVITYNOTIFICATION-18506958
- published2 Aug 2026
- disclosed31 Jul 2026
- creditUnknown
Introduced: 31 Jul 2026
New CVE NOT AVAILABLE CWE-89 (opens in a new tab)Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade activity_notification to version 2.7.0 or higher.
Overview
Affected versions of this package are vulnerable to SQL Injection via the custom_filter parameter in the bulk notification endpoints, which is passed directly to the where function as a raw SQL string. An attacker can execute arbitrary SQL commands by supplying crafted input, potentially leading to mass data modification, deletion, or unauthorized information disclosure.