Rails Activesupport vulnerabilities

CVE-2026-33176 [MEDIUM] CWE-400 CVE-2026-33176: Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails f Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Support number helpers accept strings containing scientific notation (e.g. `1e10000`), which `BigDecimal` expands into extremely large decimal representations. This can cause excessive

CVE-2026-33170 [MEDIUM] CWE-79 CVE-2026-33170: Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails f Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, `SafeBuffer#%` does not propagate the `@html_unsafe` flag to the newly created buffer. If a `SafeBuffer` is mutated in place (e.g. via `gsub!`) and then formatted with `%` using untrusted argum

CVE-2026-33169 [MEDIUM] CWE-400 CVE-2026-33169: Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails f Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. `NumberToDelimitedConverter` uses a lookahead-based regular expression with `gsub!` to insert thousands delimiters. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, the interaction between the repeated lookahead group and `gsub!` can produce

CVE-2023-38037 [MEDIUM] CWE-732 CVE-2023-38037: ActiveSupport::EncryptedFile writes contents that will be encrypted to a temporary file. The tempo ActiveSupport::EncryptedFile writes contents that will be encrypted to a temporary file. The temporary file's permissions are defaulted to the user's current `umask` settings, meaning that it's possible for other users on the same system to read the contents of the temporary file. Attackers that have access to the file system could possibly read th

CVE-2023-28120 [MEDIUM] CWE-79 CVE-2023-28120: There is a vulnerability in ActiveSupport if the new bytesplice method is called on a SafeBuffer wit There is a vulnerability in ActiveSupport if the new bytesplice method is called on a SafeBuffer with untrusted user input.