rails

Ruby on Rails

View on Rubygems

View on Github

Activity

Latest release: 1mo ago
Total releases: 519
Cadence: ~daily
Last 12 months: 16

Reach

Stars: 58.7k

Details

License: MIT
First release: Oct 25, 2004

Releases

Version	Released
`8.0.5.1` patch	Jul 29, 2026
`7.2.3.2` patch	Jul 29, 2026
`8.1.3.1` patch	Jul 29, 2026
`8.1.3` patch	Mar 24, 2026
`8.0.5` patch	Mar 24, 2026
`8.1.2.1` patch	Mar 23, 2026
`8.0.4.1` patch	Mar 23, 2026
`7.2.3.1` patch	Mar 23, 2026
`8.1.2` patch	Jan 08, 2026
`8.1.1` patch	Oct 28, 2025
`8.0.4` patch	Oct 28, 2025
`7.2.3` patch	Oct 28, 2025
`7.1.6` patch	Oct 28, 2025
`7.0.10` patch	Oct 28, 2025
`8.1.0` minor	Oct 22, 2025
`8.1.0.rc1` pre	Oct 15, 2025
`8.0.3` patch	Sep 22, 2025
`8.1.0.beta1` pre	Sep 04, 2025
`8.0.2.1` patch	Aug 13, 2025
`7.2.2.2` patch	Aug 13, 2025
`7.1.5.2` patch	Aug 13, 2025
`8.0.2` patch	Mar 12, 2025
`8.0.1` patch	Dec 13, 2024
`8.0.0.1` patch	Dec 10, 2024
`7.1.5.1` patch	Dec 10, 2024
`7.2.2.1` patch	Dec 10, 2024
`7.0.8.7` patch	Dec 10, 2024
`8.0.0` major	Nov 07, 2024
`7.1.5` patch	Oct 31, 2024
`7.2.2` patch	Oct 31, 2024
`8.0.0.rc2` pre	Oct 30, 2024
`6.1.7.10` patch	Oct 23, 2024
`7.2.1.2` patch	Oct 23, 2024
`7.1.4.2` patch	Oct 23, 2024
`7.0.8.6` patch	Oct 23, 2024
`8.0.0.rc1` pre	Oct 19, 2024
`7.1.4.1` patch	Oct 15, 2024
`7.2.1.1` patch	Oct 15, 2024
`6.1.7.9` patch	Oct 15, 2024
`7.0.8.5` patch	Oct 15, 2024
`8.0.0.beta1` pre	Sep 26, 2024
`7.2.1` patch	Aug 22, 2024
`7.1.4` patch	Aug 22, 2024
`7.2.0` minor	Aug 09, 2024
`7.2.0.rc1` pre	Aug 06, 2024
`7.2.0.beta3` pre	Jul 11, 2024
`7.1.3.4` patch	Jun 04, 2024
`7.2.0.beta2` pre	Jun 04, 2024
`7.0.8.4` patch	Jun 04, 2024
`6.1.7.8` patch	Jun 04, 2024

1–50 of 519

Repository

rails/rails

Forks: 22.3k
Open issues: 487
Language: Ruby
: 6.0/ 10

rails
mvc
html
activerecord
activejob
ruby

Dependencies (13)

Depends on

8.0.5.1

Used by

15173

Supply-chain exposure

15,173 tracked projects depend on this, <1% of every package we track.

A known CVE here directly exposes every one of them.

Known CVEs (11)

CVE-2024-26143 GHSA-9822-6m93-xqf4 BIT-rails-2024-26143 Feb 27, 2024

Rails has possible XSS Vulnerability in Action Controller

6.1 / 10
Medium
Network Low None Required Changed Low Low None

Possible XSS Vulnerability in Action Controller

There is a possible XSS vulnerability when using the translation helpers (translate, t, etc) in Action Controller. This vulnerability has been assigned the CVE identifier CVE-2024-26143.

Versions Affected: >= 7.0.0. Not affected: < 7.0.0 Fixed Versions: 7.1.3.1, 7.0.8.1

Impact

Applications using translation methods like translate, or t on a controller, with a key ending in "_html", a :default key which contains untrusted user input, and the resulting string is used in a view, may be susceptible to an XSS vulnerability.

For example, impacted code will look something like this:

class ArticlesController < ApplicationController def show @message = t("message_html", default: untrusted_input) # The `show` template displays the contents of `@message` end end

To reiterate the pre-conditions, applications must:

Use a translation function from a controller (i.e. not I18n.t, or t from a view)

Use a key that ends in _html

Use a default value where the default value is untrusted and unescaped input

Send the text to the victim (whether that's part of a template, or a render call)

All users running an affected release should either upgrade or use one of the workarounds immediately.

Releases

The fixed releases are available at the normal locations.

Workarounds

There are no feasible workarounds for this issue.

Patches

To aid users who aren't able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.

7-0-translate-xss.patch - Patch for 7.0 series

7-1-translate-xss.patch - Patch for 7.1 series

Credits

Thanks to ooooooo_q for the patch and fix!

Affected versions

7.0.07.0.17.0.27.0.2.17.0.2.27.0.2.37.0.2.47.0.37.0.3.17.0.47.0.4.17.0.4.2

+ 12 more Show less

7.0.4.37.0.57.0.5.17.0.67.0.77.0.7.17.0.7.27.0.87.1.07.1.17.1.27.1.3

Fixed in

7.0.8.17.1.3.1

References

https://github.com/rails/rails/security/advisories/GHSA-9822-6m93-xqf4
https://nvd.nist.gov/vuln/detail/CVE-2024-26143
https://github.com/rails/rails/commit/4c83b331092a79d58e4adffe4be5f250fa5782cc
https://github.com/rails/rails/commit/5187a9ef51980ad1b8e81945ebe0462d28f84f9e
https://discuss.rubyonrails.org/t/possible-xss-vulnerability-in-action-controller/84947
https://github.com/rails/rails

Updated Jun 08, 2026 · Source: OSV.dev
CVE-2009-4214 GHSA-9p3v-wf2w-v29c Oct 24, 2017

Moderate severity vulnerability that affects rails

Medium

Cross-site scripting (XSS) vulnerability in the strip_tags function in Ruby on Rails before 2.2.s, and 2.3.x before 2.3.5, allows remote attackers to inject arbitrary web script or HTML via vectors involving non-printing ASCII characters, related to HTML::Tokenizer and actionpack/lib/action_controller/vendor/html-scanner/html/node.rb.

Affected versions

0.10.00.10.10.11.00.11.10.12.00.12.10.13.00.13.10.14.10.14.20.14.30.14.4

+ 35 more Show less

0.8.00.8.50.9.00.9.10.9.20.9.30.9.40.9.4.10.9.51.0.01.1.01.1.11.1.21.1.31.1.41.1.51.1.61.2.01.2.11.2.21.2.31.2.41.2.51.2.62.0.02.0.12.0.22.0.42.0.52.1.02.1.12.1.22.3.22.3.32.3.4

Fixed in

2.2.22.3.5

References

https://nvd.nist.gov/vuln/detail/CVE-2009-4214
https://github.com/advisories/GHSA-9p3v-wf2w-v29c
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rails/CVE-2009-4214.yml
http://github.com/rails/rails
http://github.com/rails/rails/commit/bfe032858077bb2946abe25e95e485ba6da86bd5
http://groups.google.com/group/rubyonrails-security/browse_thread/thread/4d4f71f2aef4c0ab?pli=1

Updated Apr 09, 2025 · Source: OSV.dev
CVE-2006-4112 GHSA-9wrq-xvmp-xjc8 Oct 24, 2017

Rails Denial of Service vulnerability

High

Unspecified vulnerability in the "dependency resolution mechanism" in Ruby on Rails 1.1.0 through 1.1.5 allows remote attackers to execute arbitrary Ruby code via a URL that is not properly handled in the routing code, which leads to a denial of service (application hang) or "data loss," a different vulnerability than CVE-2006-4111.

Affected versions

1.1.01.1.11.1.21.1.31.1.41.1.5

Fixed in

1.1.6

References

https://nvd.nist.gov/vuln/detail/CVE-2006-4112
https://exchange.xforce.ibmcloud.com/vulnerabilities/28364
https://github.com/rails/rails
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rails/CVE-2006-4112.yml
https://web.archive.org/web/20200301174340/http://www.securityfocus.com/bid/19454
https://web.archive.org/web/20200804225700/http://www.securityfocus.com/archive/1/442934/100/0/threaded

Updated Apr 03, 2025 · Source: OSV.dev
CVE-2007-5379 GHSA-fjfg-q662-gm6j Oct 24, 2017

Moderate severity vulnerability that affects rails

Medium

Rails before 1.2.4, as used for Ruby on Rails, allows remote attackers and ActiveResource servers to determine the existence of arbitrary files and read arbitrary XML files via the Hash.from_xml (Hash#from_xml) method, which uses XmlSimple (XML::Simple) unsafely, as demonstrated by reading passwords from the Pidgin (Gaim) .purple/accounts.xml file.

Affected versions

0.10.00.10.10.11.00.11.10.12.00.12.10.13.00.13.10.14.10.14.20.14.30.14.4

+ 21 more Show less

0.8.00.8.50.9.00.9.10.9.20.9.30.9.40.9.4.10.9.51.0.01.1.01.1.11.1.21.1.31.1.41.1.51.1.61.2.01.2.11.2.21.2.3

Fixed in

1.2.4

References

https://nvd.nist.gov/vuln/detail/CVE-2007-5379
https://github.com/rails/rails
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rails/CVE-2007-5379.yml
https://rubyonrails.org/2007/10/5/rails-1-2-4-maintenance-release
https://web.archive.org/web/20090602000500/http://dev.rubyonrails.org/ticket/8453
http://bugs.gentoo.org/show_bug.cgi?id=195315

Updated May 01, 2025 · Source: OSV.dev
CVE-2007-3227 GHSA-gm25-fpmr-43fj Oct 24, 2017

Moderate severity vulnerability that affects rails

Medium

Cross-site scripting (XSS) vulnerability in the to_json (ActiveRecord::Base#to_json) function in Ruby on Rails before edge 9606 allows remote attackers to inject arbitrary web script via the input values.

Affected versions

0.10.00.10.10.11.00.11.10.12.00.12.10.13.00.13.10.14.10.14.20.14.30.14.4

+ 22 more Show less

0.8.00.8.50.9.00.9.10.9.20.9.30.9.40.9.4.10.9.51.0.01.1.01.1.11.1.21.1.31.1.41.1.51.1.61.2.01.2.11.2.21.2.31.2.4

Fixed in

1.2.5

References

https://nvd.nist.gov/vuln/detail/CVE-2007-3227
https://github.com/advisories/GHSA-gm25-fpmr-43fj
https://github.com/rails/rails
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rails/CVE-2007-3227.yml
http://bugs.gentoo.org/show_bug.cgi?id=195315
http://dev.rubyonrails.org/ticket/8371

Updated Apr 09, 2025 · Source: OSV.dev
CVE-2008-5189 GHSA-jmgf-p46x-982h Oct 24, 2017

rails is vulnerable to CRLF injection

Medium

CRLF injection vulnerability in Ruby on Rails before 2.0.5 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted URL to the redirect_to function.

Affected versions

0.10.00.10.10.11.00.11.10.12.00.12.10.13.00.13.10.14.10.14.20.14.30.14.4

+ 28 more Show less

0.8.00.8.50.9.00.9.10.9.20.9.30.9.40.9.4.10.9.51.0.01.1.01.1.11.1.21.1.31.1.41.1.51.1.61.2.01.2.11.2.21.2.31.2.41.2.51.2.62.0.02.0.12.0.22.0.4

Fixed in

2.0.5

References

https://nvd.nist.gov/vuln/detail/CVE-2008-5189
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rails/CVE-2008-5189.yml
http://github.com/rails/rails
http://github.com/rails/rails/commit/7282ed863ca7e6f928bae9162c9a63a98775a19d
http://lists.opensuse.org/opensuse-security-announce/2008-12/msg00002.html
http://weblog.rubyonrails.org/2008/10/19/rails-2-0-5-redirect_to-and-offset-limit-sanitizing

Updated Apr 09, 2025 · Source: OSV.dev
CVE-2007-5380 GHSA-jwhv-rgqc-fqj5 Oct 24, 2017

Session fixation vulnerability in Rails

Medium

Session fixation vulnerability in Rails before 1.2.4, as used for Ruby on Rails, allows remote attackers to hijack web sessions via unspecified vectors related to "URL-based sessions."

Affected versions

0.10.00.10.10.11.00.11.10.12.00.12.10.13.00.13.10.14.10.14.20.14.30.14.4

+ 21 more Show less

0.8.00.8.50.9.00.9.10.9.20.9.30.9.40.9.4.10.9.51.0.01.1.01.1.11.1.21.1.31.1.41.1.51.1.61.2.01.2.11.2.21.2.3

Fixed in

1.2.4

References

https://nvd.nist.gov/vuln/detail/CVE-2007-5380
https://github.com/advisories/GHSA-jwhv-rgqc-fqj5
https://github.com/rails/rails
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rails/CVE-2007-5380.yml
http://bugs.gentoo.org/show_bug.cgi?id=195315
http://docs.info.apple.com/article.html?artnum=307179

Updated Apr 09, 2025 · Source: OSV.dev
CVE-2007-6077 GHSA-p4c6-77gc-694x Oct 24, 2017

session fixation protection mechanism in cgi_process.rb in Rails

Medium

The session fixation protection mechanism in cgi_process.rb in Rails 1.2.4, as used in Ruby on Rails, removes the :cookie_only attribute from the DEFAULT_SESSION_OPTIONS constant, which effectively causes cookie_only to be applied only to the first instantiation of CgiRequest, which allows remote attackers to conduct session fixation attacks. NOTE: this is due to an incomplete fix for CVE-2007-5380.

Affected versions

0.10.00.10.10.11.00.11.10.12.00.12.10.13.00.13.10.14.10.14.20.14.30.14.4

+ 23 more Show less

0.8.00.8.50.9.00.9.10.9.20.9.30.9.40.9.4.10.9.51.0.01.1.01.1.11.1.21.1.31.1.41.1.51.1.61.2.01.2.11.2.21.2.31.2.41.2.5

Fixed in

1.2.6

References

https://nvd.nist.gov/vuln/detail/CVE-2007-6077
https://github.com/advisories/GHSA-p4c6-77gc-694x
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rails/CVE-2007-6077.yml
https://rubyonrails.org/2007/11/24/ruby-on-rails-1-2-6-security-and-maintenance-release
http://dev.rubyonrails.org/changeset/8177
http://dev.rubyonrails.org/ticket/10048

Updated Apr 09, 2025 · Source: OSV.dev
CVE-2006-4111 GHSA-rvpq-5xqx-pfpp Oct 24, 2017

Ruby on Rails vulnerable to code injection

High

Ruby on Rails before 1.1.5 allows remote attackers to execute Ruby code with "severe" or "serious" impact via a File Upload request with an HTTP header that modifies the LOAD_PATH variable, a different vulnerability than CVE-2006-4112.

Affected versions

1.1.01.1.11.1.21.1.31.1.41.1.5

Fixed in

1.1.6

References

https://nvd.nist.gov/vuln/detail/CVE-2006-4111
https://github.com/presidentbeef/rails-security-history/blob/master/vulnerabilities.md
https://github.com/rails/rails
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rails/CVE-2006-4111.yml
https://web.archive.org/web/20200301174340/http://www.securityfocus.com/bid/19454
https://web.archive.org/web/20200808083046/http://securitytracker.com/id?1016673

Updated Apr 03, 2025 · Source: OSV.dev
CVE-2009-2422 GHSA-rxq3-gm4p-5fj4 Oct 24, 2017

rails vulnerable to improper authentication

9.8 / 10
Critical
Network Low None None Unchanged High High High

The example code for the digest authentication functionality (http_authentication.rb) in Ruby on Rails before 2.3.3 defines an authenticate_or_request_with_http_digest block that returns nil instead of false when the user does not exist, which allows context-dependent attackers to bypass authentication for applications that are derived from this example by sending an invalid username without a password.

Affected versions

0.10.00.10.10.11.00.11.10.12.00.12.10.13.00.13.10.14.10.14.20.14.30.14.4

+ 35 more Show less

0.8.00.8.50.9.00.9.10.9.20.9.30.9.40.9.4.10.9.51.0.01.1.01.1.11.1.21.1.31.1.41.1.51.1.61.2.01.2.11.2.21.2.31.2.41.2.51.2.62.0.02.0.12.0.22.0.42.0.52.1.02.1.12.1.22.2.22.2.32.3.2

Fixed in

2.3.3

References

https://nvd.nist.gov/vuln/detail/CVE-2009-2422
https://exchange.xforce.ibmcloud.com/vulnerabilities/51528
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rails/CVE-2009-2422.yml
https://web.archive.org/web/20090711160153/http://secunia.com/advisories/35702
https://web.archive.org/web/20200229192617/http://www.securityfocus.com/bid/35579
http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html

Updated Feb 16, 2024 · Source: OSV.dev

1–10 of 11

Insights

Releases per month

last 12 months

Release mix

major 8
minor 21
patch 315
pre 174

519 releases

Dependencies over time

per release

Minimum runtime

over time

Release calendar

2026

Jan

Feb

Mar

Apr

May

Jun

Jul

Aug

Sep

Oct

Nov

Dec

Less More