Activerecord Project Activerecord vulnerabilities

CVE-2013-3221 [CRITICAL] CWE-20 Active Record component in Ruby on Rails has a data-type injection vulnerability Active Record component in Ruby on Rails has a data-type injection vulnerability The Active Record component in Ruby on Rails 2.3.x, 3.0.x, 3.1.x, and 3.2.x does not ensure that the declared data type of a database column is used during comparisons of input values to stored values in that column, which makes it easier for remote attackers to conduct data-type injection attacks agains

CVE-2013-0276 [MEDIUM] CWE-284 ActiveRecord vulnerable to modification of protected model attributes ActiveRecord vulnerable to modification of protected model attributes ActiveRecord in Ruby on Rails before 2.3.17, 3.1.x before 3.1.11, and 3.2.x before 3.2.12 allows remote attackers to bypass the `attr_protected` protection mechanism and modify protected model attributes via a crafted request.

CVE-2013-1854 [MEDIUM] CWE-20 Active Record Improper Input Validation Active Record Improper Input Validation The Active Record component in Ruby on Rails 2.3.x before 2.3.18, 3.1.x before 3.1.12, and 3.2.x before 3.2.13 processes certain queries by converting hash keys to symbols, which allows remote attackers to cause a denial of service via crafted input to a where method.

CVE-2025-55193 [LOW] CWE-150 Active Record logging vulnerable to ANSI escape injection Active Record logging vulnerable to ANSI escape injection This vulnerability has been assigned the CVE identifier CVE-2025-55193 ### Impact The ID passed to `find` or similar methods may be logged without escaping. If this is directly to the terminal it may include unescaped ANSI sequences. ### Releases The fixed releases are available at the normal locations. ### Credits Thanks to [lio346](https://hacker