simple_form

Version	Released
`5.4.1` patch	Jan 05, 2026
`5.4.0` minor	Oct 24, 2025
`5.3.1` patch	May 24, 2024
`5.3.0` minor	Oct 11, 2023
`5.2.0` minor	Jan 29, 2023
`5.1.0` minor	Feb 09, 2021
`5.0.3` patch	Sep 30, 2020
`5.0.2` patch	Feb 06, 2020
`5.0.1` patch	Oct 04, 2019
`5.0.0` major	Sep 27, 2019
`4.1.0` minor 1 CVE	Nov 22, 2018
`4.0.1` patch 1 CVE	May 18, 2018
`4.0.0` major 1 CVE	Apr 11, 2018
`3.5.1` patch 1 CVE	Feb 15, 2018
`3.5.0` minor 1 CVE	May 17, 2017
`3.4.0` minor 1 CVE	Jan 06, 2017
`3.3.1` patch 1 CVE	Aug 26, 2016
`3.3.0` minor 1 CVE	Aug 25, 2016
`3.2.1` patch 1 CVE	Dec 20, 2015
`3.2.0` minor 1 CVE	Sep 22, 2015
`3.1.1` patch 1 CVE	Aug 30, 2015
`3.0.4` patch 1 CVE	Jul 30, 2015
`2.1.3` patch 1 CVE	Jul 02, 2015
`2.1.2` patch 1 CVE	Nov 25, 2014
`3.1.0` minor 1 CVE	Nov 25, 2014
`3.0.3` patch 1 CVE	Nov 25, 2014
`3.1.0.rc2` pre 1 CVE	Jul 08, 2014
`3.1.0.rc1` pre 1 CVE	Apr 14, 2014
`3.0.2` patch 1 CVE	Apr 09, 2014
`2.1.1` patch 1 CVE	Nov 29, 2013
`3.0.1` patch 1 CVE	Nov 29, 2013
`3.0.0` major 1 CVE	Sep 21, 2013
`3.0.0.rc` pre 1 CVE	May 10, 2013
`2.1.0` minor 1 CVE	Feb 26, 2013
`3.0.0.beta1` pre 1 CVE	Feb 26, 2013
`2.0.4` patch 1 CVE	Oct 08, 2012
`2.0.3` patch 1 CVE	Sep 27, 2012
`2.0.2` patch 1 CVE	Apr 30, 2012
`2.0.1` patch 1 CVE	Feb 27, 2012
`2.0.0` major 1 CVE	Feb 23, 2012
`2.0.0.rc` pre 1 CVE	Feb 01, 2012
`1.5.2` patch 1 CVE	Sep 23, 2011
`1.5.1` patch 1 CVE	Sep 15, 2011
`1.5.0` minor 1 CVE	Sep 08, 2011
`1.4.2` patch 1 CVE	Jun 27, 2011
`1.4.1` patch 1 CVE	Jun 14, 2011
`1.4.0` minor 1 CVE	May 18, 2011
`1.3.1` patch 1 CVE	Feb 06, 2011
`1.3.0` minor 1 CVE	Dec 08, 2010
`1.0.4` patch 1 CVE	Oct 08, 2010

5.4.1 patch

Jan 05, 2026

5.4.0 minor

Oct 24, 2025

5.3.1 patch

May 24, 2024

5.3.0 minor

Oct 11, 2023

5.2.0 minor

Jan 29, 2023

5.1.0 minor

Feb 09, 2021

5.0.3 patch

Sep 30, 2020

5.0.2 patch

Feb 06, 2020

5.0.1 patch

Oct 04, 2019

5.0.0 major

Sep 27, 2019

4.1.0 minor

1 CVE

CVE-2019-16676 GHSA-r74q-gxcg-73hx Sep 30, 2019

Improper Input Validation in simple_form

9.8 / 10

Critical

Network Low None None Unchanged High High High

Incorrect Access Control in `file_method?` in `lib/simple_form/form_builder.rb`; a user-supplied string is invoked as a method call

Impact

For pages that build a form using user input, it is possible for an attacker to manipulate the input and send any method present in the form object. For example:

<%= simple_form_for @user do |f| %>
  <%= f.label @user_supplied_string %>
  ...
<% end %>

The string provided in the variable @user_supplied_string would be invoked as a method call inside the @user object (unless the string contains any of the following: password, time_zone, country, email, phone and url).

By manipulation that input, an attacker could do any of the following:

Code execution (call actions like #destroy)
Denial of Service (by executing a computation intensive method)
Information Disclosure (check the presence of methods, leak user information)

Patches

The problem was fixed in version 5.0. Although it's a major version, there should be no issues with upgrading for 4.x. The reason it was released in a major version is that the configuration SimpleForm.file_methods was deprecated in order to fix the problem.

Workarounds

The issue only happens with pages that build forms based on user-provided input. If your application doesn't do that, you're not affected. A workaround is to explicitly pass which type you want for an input since the issue lies on Simple Form's automatically discovery of input types. This can be done using the as option, like the following:

<%= form.input :avatar, as: :file %>

References

[TDB]

For more information

If you have any questions or comments about this advisory:

Open an issue in https://github.com/plataformatec/simple_form
Email us at opensource@plataformatec.com.br

Affected versions


          0.4.0

0.5


          1.0.0


          1.0.1


          1.0.2


          1.0.3


          1.0.4


          1.1.0


          1.1.1


          1.1.2


          1.1.3


          1.2.0

+ 41 more


            1.2.1


            1.2.2


            1.3.0


            1.3.1


            1.4.0


            1.4.1


            1.4.2


            1.5.0


            1.5.1


            1.5.2


            2.0.0


            2.0.0.rc


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.1.0


            2.1.1


            2.1.2


            2.1.3


            3.0.0


            3.0.0.beta1


            3.0.0.rc


            3.0.1


            3.0.2


            3.0.3


            3.0.4


            3.1.0


            3.1.0.rc1


            3.1.0.rc2


            3.1.1


            3.2.0


            3.2.1


            3.3.0


            3.3.1


            3.4.0


            3.5.0


            3.5.1


            4.0.0


            4.0.1


            4.1.0

Fixed in


          5.0.0

References

Updated Aug 27, 2026 · Source: OSV.dev

Nov 22, 2018

4.0.1 patch

1 CVE

CVE-2019-16676 GHSA-r74q-gxcg-73hx Sep 30, 2019

Improper Input Validation in simple_form

9.8 / 10

Critical

Network Low None None Unchanged High High High

Incorrect Access Control in `file_method?` in `lib/simple_form/form_builder.rb`; a user-supplied string is invoked as a method call

Impact

For pages that build a form using user input, it is possible for an attacker to manipulate the input and send any method present in the form object. For example:

<%= simple_form_for @user do |f| %>
  <%= f.label @user_supplied_string %>
  ...
<% end %>

The string provided in the variable @user_supplied_string would be invoked as a method call inside the @user object (unless the string contains any of the following: password, time_zone, country, email, phone and url).

By manipulation that input, an attacker could do any of the following:

Code execution (call actions like #destroy)
Denial of Service (by executing a computation intensive method)
Information Disclosure (check the presence of methods, leak user information)

Patches

The problem was fixed in version 5.0. Although it's a major version, there should be no issues with upgrading for 4.x. The reason it was released in a major version is that the configuration SimpleForm.file_methods was deprecated in order to fix the problem.

Workarounds

The issue only happens with pages that build forms based on user-provided input. If your application doesn't do that, you're not affected. A workaround is to explicitly pass which type you want for an input since the issue lies on Simple Form's automatically discovery of input types. This can be done using the as option, like the following:

<%= form.input :avatar, as: :file %>

References

[TDB]

For more information

If you have any questions or comments about this advisory:

Open an issue in https://github.com/plataformatec/simple_form
Email us at opensource@plataformatec.com.br

Affected versions


          0.4.0

0.5


          1.0.0


          1.0.1


          1.0.2


          1.0.3


          1.0.4


          1.1.0


          1.1.1


          1.1.2


          1.1.3


          1.2.0

+ 41 more


            1.2.1


            1.2.2


            1.3.0


            1.3.1


            1.4.0


            1.4.1


            1.4.2


            1.5.0


            1.5.1


            1.5.2


            2.0.0


            2.0.0.rc


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.1.0


            2.1.1


            2.1.2


            2.1.3


            3.0.0


            3.0.0.beta1


            3.0.0.rc


            3.0.1


            3.0.2


            3.0.3


            3.0.4


            3.1.0


            3.1.0.rc1


            3.1.0.rc2


            3.1.1


            3.2.0


            3.2.1


            3.3.0


            3.3.1


            3.4.0


            3.5.0


            3.5.1


            4.0.0


            4.0.1


            4.1.0

Fixed in


          5.0.0

References

Updated Aug 27, 2026 · Source: OSV.dev

May 18, 2018

4.0.0 major

1 CVE

CVE-2019-16676 GHSA-r74q-gxcg-73hx Sep 30, 2019

Improper Input Validation in simple_form

9.8 / 10

Critical

Network Low None None Unchanged High High High

Incorrect Access Control in `file_method?` in `lib/simple_form/form_builder.rb`; a user-supplied string is invoked as a method call

Impact

For pages that build a form using user input, it is possible for an attacker to manipulate the input and send any method present in the form object. For example:

<%= simple_form_for @user do |f| %>
  <%= f.label @user_supplied_string %>
  ...
<% end %>

The string provided in the variable @user_supplied_string would be invoked as a method call inside the @user object (unless the string contains any of the following: password, time_zone, country, email, phone and url).

By manipulation that input, an attacker could do any of the following:

Code execution (call actions like #destroy)
Denial of Service (by executing a computation intensive method)
Information Disclosure (check the presence of methods, leak user information)

Patches

The problem was fixed in version 5.0. Although it's a major version, there should be no issues with upgrading for 4.x. The reason it was released in a major version is that the configuration SimpleForm.file_methods was deprecated in order to fix the problem.

Workarounds

The issue only happens with pages that build forms based on user-provided input. If your application doesn't do that, you're not affected. A workaround is to explicitly pass which type you want for an input since the issue lies on Simple Form's automatically discovery of input types. This can be done using the as option, like the following:

<%= form.input :avatar, as: :file %>

References

[TDB]

For more information

If you have any questions or comments about this advisory:

Open an issue in https://github.com/plataformatec/simple_form
Email us at opensource@plataformatec.com.br

Affected versions


          0.4.0

0.5


          1.0.0


          1.0.1


          1.0.2


          1.0.3


          1.0.4


          1.1.0


          1.1.1


          1.1.2


          1.1.3


          1.2.0

+ 41 more


            1.2.1


            1.2.2


            1.3.0


            1.3.1


            1.4.0


            1.4.1


            1.4.2


            1.5.0


            1.5.1


            1.5.2


            2.0.0


            2.0.0.rc


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.1.0


            2.1.1


            2.1.2


            2.1.3


            3.0.0


            3.0.0.beta1


            3.0.0.rc


            3.0.1


            3.0.2


            3.0.3


            3.0.4


            3.1.0


            3.1.0.rc1


            3.1.0.rc2


            3.1.1


            3.2.0


            3.2.1


            3.3.0


            3.3.1


            3.4.0


            3.5.0


            3.5.1


            4.0.0


            4.0.1


            4.1.0

Fixed in


          5.0.0

References

Updated Aug 27, 2026 · Source: OSV.dev

Apr 11, 2018

3.5.1 patch

1 CVE

CVE-2019-16676 GHSA-r74q-gxcg-73hx Sep 30, 2019

Improper Input Validation in simple_form

9.8 / 10

Critical

Network Low None None Unchanged High High High

Incorrect Access Control in `file_method?` in `lib/simple_form/form_builder.rb`; a user-supplied string is invoked as a method call

Impact

For pages that build a form using user input, it is possible for an attacker to manipulate the input and send any method present in the form object. For example:

<%= simple_form_for @user do |f| %>
  <%= f.label @user_supplied_string %>
  ...
<% end %>

The string provided in the variable @user_supplied_string would be invoked as a method call inside the @user object (unless the string contains any of the following: password, time_zone, country, email, phone and url).

By manipulation that input, an attacker could do any of the following:

Code execution (call actions like #destroy)
Denial of Service (by executing a computation intensive method)
Information Disclosure (check the presence of methods, leak user information)

Patches

The problem was fixed in version 5.0. Although it's a major version, there should be no issues with upgrading for 4.x. The reason it was released in a major version is that the configuration SimpleForm.file_methods was deprecated in order to fix the problem.

Workarounds

The issue only happens with pages that build forms based on user-provided input. If your application doesn't do that, you're not affected. A workaround is to explicitly pass which type you want for an input since the issue lies on Simple Form's automatically discovery of input types. This can be done using the as option, like the following:

<%= form.input :avatar, as: :file %>

References

[TDB]

For more information

If you have any questions or comments about this advisory:

Open an issue in https://github.com/plataformatec/simple_form
Email us at opensource@plataformatec.com.br

Affected versions


          0.4.0

0.5


          1.0.0


          1.0.1


          1.0.2


          1.0.3


          1.0.4


          1.1.0


          1.1.1


          1.1.2


          1.1.3


          1.2.0

+ 41 more


            1.2.1


            1.2.2


            1.3.0


            1.3.1


            1.4.0


            1.4.1


            1.4.2


            1.5.0


            1.5.1


            1.5.2


            2.0.0


            2.0.0.rc


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.1.0


            2.1.1


            2.1.2


            2.1.3


            3.0.0


            3.0.0.beta1


            3.0.0.rc


            3.0.1


            3.0.2


            3.0.3


            3.0.4


            3.1.0


            3.1.0.rc1


            3.1.0.rc2


            3.1.1


            3.2.0


            3.2.1


            3.3.0


            3.3.1


            3.4.0


            3.5.0


            3.5.1


            4.0.0


            4.0.1


            4.1.0

Fixed in


          5.0.0

References

Updated Aug 27, 2026 · Source: OSV.dev

Feb 15, 2018

3.5.0 minor

1 CVE

CVE-2019-16676 GHSA-r74q-gxcg-73hx Sep 30, 2019

Improper Input Validation in simple_form

9.8 / 10

Critical

Network Low None None Unchanged High High High

Incorrect Access Control in `file_method?` in `lib/simple_form/form_builder.rb`; a user-supplied string is invoked as a method call

Impact

For pages that build a form using user input, it is possible for an attacker to manipulate the input and send any method present in the form object. For example:

<%= simple_form_for @user do |f| %>
  <%= f.label @user_supplied_string %>
  ...
<% end %>

The string provided in the variable @user_supplied_string would be invoked as a method call inside the @user object (unless the string contains any of the following: password, time_zone, country, email, phone and url).

By manipulation that input, an attacker could do any of the following:

Code execution (call actions like #destroy)
Denial of Service (by executing a computation intensive method)
Information Disclosure (check the presence of methods, leak user information)

Patches

The problem was fixed in version 5.0. Although it's a major version, there should be no issues with upgrading for 4.x. The reason it was released in a major version is that the configuration SimpleForm.file_methods was deprecated in order to fix the problem.

Workarounds

The issue only happens with pages that build forms based on user-provided input. If your application doesn't do that, you're not affected. A workaround is to explicitly pass which type you want for an input since the issue lies on Simple Form's automatically discovery of input types. This can be done using the as option, like the following:

<%= form.input :avatar, as: :file %>

References

[TDB]

For more information

If you have any questions or comments about this advisory:

Open an issue in https://github.com/plataformatec/simple_form
Email us at opensource@plataformatec.com.br

Affected versions


          0.4.0

0.5


          1.0.0


          1.0.1


          1.0.2


          1.0.3


          1.0.4


          1.1.0


          1.1.1


          1.1.2


          1.1.3


          1.2.0

+ 41 more


            1.2.1


            1.2.2


            1.3.0


            1.3.1


            1.4.0


            1.4.1


            1.4.2


            1.5.0


            1.5.1


            1.5.2


            2.0.0


            2.0.0.rc


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.1.0


            2.1.1


            2.1.2


            2.1.3


            3.0.0


            3.0.0.beta1


            3.0.0.rc


            3.0.1


            3.0.2


            3.0.3


            3.0.4


            3.1.0


            3.1.0.rc1


            3.1.0.rc2


            3.1.1


            3.2.0


            3.2.1


            3.3.0


            3.3.1


            3.4.0


            3.5.0


            3.5.1


            4.0.0


            4.0.1


            4.1.0

Fixed in


          5.0.0

References

Updated Aug 27, 2026 · Source: OSV.dev

May 17, 2017

3.4.0 minor

1 CVE

CVE-2019-16676 GHSA-r74q-gxcg-73hx Sep 30, 2019

Improper Input Validation in simple_form

9.8 / 10

Critical

Network Low None None Unchanged High High High

Incorrect Access Control in `file_method?` in `lib/simple_form/form_builder.rb`; a user-supplied string is invoked as a method call

Impact

For pages that build a form using user input, it is possible for an attacker to manipulate the input and send any method present in the form object. For example:

<%= simple_form_for @user do |f| %>
  <%= f.label @user_supplied_string %>
  ...
<% end %>

The string provided in the variable @user_supplied_string would be invoked as a method call inside the @user object (unless the string contains any of the following: password, time_zone, country, email, phone and url).

By manipulation that input, an attacker could do any of the following:

Code execution (call actions like #destroy)
Denial of Service (by executing a computation intensive method)
Information Disclosure (check the presence of methods, leak user information)

Patches

The problem was fixed in version 5.0. Although it's a major version, there should be no issues with upgrading for 4.x. The reason it was released in a major version is that the configuration SimpleForm.file_methods was deprecated in order to fix the problem.

Workarounds

The issue only happens with pages that build forms based on user-provided input. If your application doesn't do that, you're not affected. A workaround is to explicitly pass which type you want for an input since the issue lies on Simple Form's automatically discovery of input types. This can be done using the as option, like the following:

<%= form.input :avatar, as: :file %>

References

[TDB]

For more information

If you have any questions or comments about this advisory:

Open an issue in https://github.com/plataformatec/simple_form
Email us at opensource@plataformatec.com.br

Affected versions


          0.4.0

0.5


          1.0.0


          1.0.1


          1.0.2


          1.0.3


          1.0.4


          1.1.0


          1.1.1


          1.1.2


          1.1.3


          1.2.0

+ 41 more


            1.2.1


            1.2.2


            1.3.0


            1.3.1


            1.4.0


            1.4.1


            1.4.2


            1.5.0


            1.5.1


            1.5.2


            2.0.0


            2.0.0.rc


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.1.0


            2.1.1


            2.1.2


            2.1.3


            3.0.0


            3.0.0.beta1


            3.0.0.rc


            3.0.1


            3.0.2


            3.0.3


            3.0.4


            3.1.0


            3.1.0.rc1


            3.1.0.rc2


            3.1.1


            3.2.0


            3.2.1


            3.3.0


            3.3.1


            3.4.0


            3.5.0


            3.5.1


            4.0.0


            4.0.1


            4.1.0

Fixed in


          5.0.0

References

Updated Aug 27, 2026 · Source: OSV.dev

Jan 06, 2017

3.3.1 patch

1 CVE

CVE-2019-16676 GHSA-r74q-gxcg-73hx Sep 30, 2019

Improper Input Validation in simple_form

9.8 / 10

Critical

Network Low None None Unchanged High High High

Incorrect Access Control in `file_method?` in `lib/simple_form/form_builder.rb`; a user-supplied string is invoked as a method call

Impact

For pages that build a form using user input, it is possible for an attacker to manipulate the input and send any method present in the form object. For example:

<%= simple_form_for @user do |f| %>
  <%= f.label @user_supplied_string %>
  ...
<% end %>

The string provided in the variable @user_supplied_string would be invoked as a method call inside the @user object (unless the string contains any of the following: password, time_zone, country, email, phone and url).

By manipulation that input, an attacker could do any of the following:

Code execution (call actions like #destroy)
Denial of Service (by executing a computation intensive method)
Information Disclosure (check the presence of methods, leak user information)

Patches

The problem was fixed in version 5.0. Although it's a major version, there should be no issues with upgrading for 4.x. The reason it was released in a major version is that the configuration SimpleForm.file_methods was deprecated in order to fix the problem.

Workarounds

The issue only happens with pages that build forms based on user-provided input. If your application doesn't do that, you're not affected. A workaround is to explicitly pass which type you want for an input since the issue lies on Simple Form's automatically discovery of input types. This can be done using the as option, like the following:

<%= form.input :avatar, as: :file %>

References

[TDB]

For more information

If you have any questions or comments about this advisory:

Open an issue in https://github.com/plataformatec/simple_form
Email us at opensource@plataformatec.com.br

Affected versions


          0.4.0

0.5


          1.0.0


          1.0.1


          1.0.2


          1.0.3


          1.0.4


          1.1.0


          1.1.1


          1.1.2


          1.1.3


          1.2.0

+ 41 more


            1.2.1


            1.2.2


            1.3.0


            1.3.1


            1.4.0


            1.4.1


            1.4.2


            1.5.0


            1.5.1


            1.5.2


            2.0.0


            2.0.0.rc


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.1.0


            2.1.1


            2.1.2


            2.1.3


            3.0.0


            3.0.0.beta1


            3.0.0.rc


            3.0.1


            3.0.2


            3.0.3


            3.0.4


            3.1.0


            3.1.0.rc1


            3.1.0.rc2


            3.1.1


            3.2.0


            3.2.1


            3.3.0


            3.3.1


            3.4.0


            3.5.0


            3.5.1


            4.0.0


            4.0.1


            4.1.0

Fixed in


          5.0.0

References

Updated Aug 27, 2026 · Source: OSV.dev

Aug 26, 2016

3.3.0 minor

1 CVE

CVE-2019-16676 GHSA-r74q-gxcg-73hx Sep 30, 2019

Improper Input Validation in simple_form

9.8 / 10

Critical

Network Low None None Unchanged High High High

Incorrect Access Control in `file_method?` in `lib/simple_form/form_builder.rb`; a user-supplied string is invoked as a method call

Impact

For pages that build a form using user input, it is possible for an attacker to manipulate the input and send any method present in the form object. For example:

<%= simple_form_for @user do |f| %>
  <%= f.label @user_supplied_string %>
  ...
<% end %>

The string provided in the variable @user_supplied_string would be invoked as a method call inside the @user object (unless the string contains any of the following: password, time_zone, country, email, phone and url).

By manipulation that input, an attacker could do any of the following:

Code execution (call actions like #destroy)
Denial of Service (by executing a computation intensive method)
Information Disclosure (check the presence of methods, leak user information)

Patches

The problem was fixed in version 5.0. Although it's a major version, there should be no issues with upgrading for 4.x. The reason it was released in a major version is that the configuration SimpleForm.file_methods was deprecated in order to fix the problem.

Workarounds

The issue only happens with pages that build forms based on user-provided input. If your application doesn't do that, you're not affected. A workaround is to explicitly pass which type you want for an input since the issue lies on Simple Form's automatically discovery of input types. This can be done using the as option, like the following:

<%= form.input :avatar, as: :file %>

References

[TDB]

For more information

If you have any questions or comments about this advisory:

Open an issue in https://github.com/plataformatec/simple_form
Email us at opensource@plataformatec.com.br

Affected versions


          0.4.0

0.5


          1.0.0


          1.0.1


          1.0.2


          1.0.3


          1.0.4


          1.1.0


          1.1.1


          1.1.2


          1.1.3


          1.2.0

+ 41 more


            1.2.1


            1.2.2


            1.3.0


            1.3.1


            1.4.0


            1.4.1


            1.4.2


            1.5.0


            1.5.1


            1.5.2


            2.0.0


            2.0.0.rc


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.1.0


            2.1.1


            2.1.2


            2.1.3


            3.0.0


            3.0.0.beta1


            3.0.0.rc


            3.0.1


            3.0.2


            3.0.3


            3.0.4


            3.1.0


            3.1.0.rc1


            3.1.0.rc2


            3.1.1


            3.2.0


            3.2.1


            3.3.0


            3.3.1


            3.4.0


            3.5.0


            3.5.1


            4.0.0


            4.0.1


            4.1.0

Fixed in


          5.0.0

References

Updated Aug 27, 2026 · Source: OSV.dev

Aug 25, 2016

3.2.1 patch

1 CVE

CVE-2019-16676 GHSA-r74q-gxcg-73hx Sep 30, 2019

Improper Input Validation in simple_form

9.8 / 10

Critical

Network Low None None Unchanged High High High

Incorrect Access Control in `file_method?` in `lib/simple_form/form_builder.rb`; a user-supplied string is invoked as a method call

Impact

For pages that build a form using user input, it is possible for an attacker to manipulate the input and send any method present in the form object. For example:

<%= simple_form_for @user do |f| %>
  <%= f.label @user_supplied_string %>
  ...
<% end %>

The string provided in the variable @user_supplied_string would be invoked as a method call inside the @user object (unless the string contains any of the following: password, time_zone, country, email, phone and url).

By manipulation that input, an attacker could do any of the following:

Code execution (call actions like #destroy)
Denial of Service (by executing a computation intensive method)
Information Disclosure (check the presence of methods, leak user information)

Patches

The problem was fixed in version 5.0. Although it's a major version, there should be no issues with upgrading for 4.x. The reason it was released in a major version is that the configuration SimpleForm.file_methods was deprecated in order to fix the problem.

Workarounds

The issue only happens with pages that build forms based on user-provided input. If your application doesn't do that, you're not affected. A workaround is to explicitly pass which type you want for an input since the issue lies on Simple Form's automatically discovery of input types. This can be done using the as option, like the following:

<%= form.input :avatar, as: :file %>

References

[TDB]

For more information

If you have any questions or comments about this advisory:

Open an issue in https://github.com/plataformatec/simple_form
Email us at opensource@plataformatec.com.br

Affected versions


          0.4.0

0.5


          1.0.0


          1.0.1


          1.0.2


          1.0.3


          1.0.4


          1.1.0


          1.1.1


          1.1.2


          1.1.3


          1.2.0

+ 41 more


            1.2.1


            1.2.2


            1.3.0


            1.3.1


            1.4.0


            1.4.1


            1.4.2


            1.5.0


            1.5.1


            1.5.2


            2.0.0


            2.0.0.rc


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.1.0


            2.1.1


            2.1.2


            2.1.3


            3.0.0


            3.0.0.beta1


            3.0.0.rc


            3.0.1


            3.0.2


            3.0.3


            3.0.4


            3.1.0


            3.1.0.rc1


            3.1.0.rc2


            3.1.1


            3.2.0


            3.2.1


            3.3.0


            3.3.1


            3.4.0


            3.5.0


            3.5.1


            4.0.0


            4.0.1


            4.1.0

Fixed in


          5.0.0

References

Updated Aug 27, 2026 · Source: OSV.dev

Dec 20, 2015

3.2.0 minor

1 CVE

CVE-2019-16676 GHSA-r74q-gxcg-73hx Sep 30, 2019

Improper Input Validation in simple_form

9.8 / 10

Critical

Network Low None None Unchanged High High High

Incorrect Access Control in `file_method?` in `lib/simple_form/form_builder.rb`; a user-supplied string is invoked as a method call

Impact

For pages that build a form using user input, it is possible for an attacker to manipulate the input and send any method present in the form object. For example:

<%= simple_form_for @user do |f| %>
  <%= f.label @user_supplied_string %>
  ...
<% end %>

The string provided in the variable @user_supplied_string would be invoked as a method call inside the @user object (unless the string contains any of the following: password, time_zone, country, email, phone and url).

By manipulation that input, an attacker could do any of the following:

Code execution (call actions like #destroy)
Denial of Service (by executing a computation intensive method)
Information Disclosure (check the presence of methods, leak user information)

Patches

The problem was fixed in version 5.0. Although it's a major version, there should be no issues with upgrading for 4.x. The reason it was released in a major version is that the configuration SimpleForm.file_methods was deprecated in order to fix the problem.

Workarounds

The issue only happens with pages that build forms based on user-provided input. If your application doesn't do that, you're not affected. A workaround is to explicitly pass which type you want for an input since the issue lies on Simple Form's automatically discovery of input types. This can be done using the as option, like the following:

<%= form.input :avatar, as: :file %>

References

[TDB]

For more information

If you have any questions or comments about this advisory:

Open an issue in https://github.com/plataformatec/simple_form
Email us at opensource@plataformatec.com.br

Affected versions


          0.4.0

0.5


          1.0.0


          1.0.1


          1.0.2


          1.0.3


          1.0.4


          1.1.0


          1.1.1


          1.1.2


          1.1.3


          1.2.0

+ 41 more


            1.2.1


            1.2.2


            1.3.0


            1.3.1


            1.4.0


            1.4.1


            1.4.2


            1.5.0


            1.5.1


            1.5.2


            2.0.0


            2.0.0.rc


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.1.0


            2.1.1


            2.1.2


            2.1.3


            3.0.0


            3.0.0.beta1


            3.0.0.rc


            3.0.1


            3.0.2


            3.0.3


            3.0.4


            3.1.0


            3.1.0.rc1


            3.1.0.rc2


            3.1.1


            3.2.0


            3.2.1


            3.3.0


            3.3.1


            3.4.0


            3.5.0


            3.5.1


            4.0.0


            4.0.1


            4.1.0

Fixed in


          5.0.0

References

Updated Aug 27, 2026 · Source: OSV.dev

Sep 22, 2015

3.1.1 patch

1 CVE

CVE-2019-16676 GHSA-r74q-gxcg-73hx Sep 30, 2019

Improper Input Validation in simple_form

9.8 / 10

Critical

Network Low None None Unchanged High High High

Incorrect Access Control in `file_method?` in `lib/simple_form/form_builder.rb`; a user-supplied string is invoked as a method call

Impact

For pages that build a form using user input, it is possible for an attacker to manipulate the input and send any method present in the form object. For example:

<%= simple_form_for @user do |f| %>
  <%= f.label @user_supplied_string %>
  ...
<% end %>

The string provided in the variable @user_supplied_string would be invoked as a method call inside the @user object (unless the string contains any of the following: password, time_zone, country, email, phone and url).

By manipulation that input, an attacker could do any of the following:

Code execution (call actions like #destroy)
Denial of Service (by executing a computation intensive method)
Information Disclosure (check the presence of methods, leak user information)

Patches

The problem was fixed in version 5.0. Although it's a major version, there should be no issues with upgrading for 4.x. The reason it was released in a major version is that the configuration SimpleForm.file_methods was deprecated in order to fix the problem.

Workarounds

The issue only happens with pages that build forms based on user-provided input. If your application doesn't do that, you're not affected. A workaround is to explicitly pass which type you want for an input since the issue lies on Simple Form's automatically discovery of input types. This can be done using the as option, like the following:

<%= form.input :avatar, as: :file %>

References

[TDB]

For more information

If you have any questions or comments about this advisory:

Open an issue in https://github.com/plataformatec/simple_form
Email us at opensource@plataformatec.com.br

Affected versions


          0.4.0

0.5


          1.0.0


          1.0.1


          1.0.2


          1.0.3


          1.0.4


          1.1.0


          1.1.1


          1.1.2


          1.1.3


          1.2.0

+ 41 more


            1.2.1


            1.2.2


            1.3.0


            1.3.1


            1.4.0


            1.4.1


            1.4.2


            1.5.0


            1.5.1


            1.5.2


            2.0.0


            2.0.0.rc


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.1.0


            2.1.1


            2.1.2


            2.1.3


            3.0.0


            3.0.0.beta1


            3.0.0.rc


            3.0.1


            3.0.2


            3.0.3


            3.0.4


            3.1.0


            3.1.0.rc1


            3.1.0.rc2


            3.1.1


            3.2.0


            3.2.1


            3.3.0


            3.3.1


            3.4.0


            3.5.0


            3.5.1


            4.0.0


            4.0.1


            4.1.0

Fixed in


          5.0.0

References

Updated Aug 27, 2026 · Source: OSV.dev

Aug 30, 2015

3.0.4 patch

1 CVE

CVE-2019-16676 GHSA-r74q-gxcg-73hx Sep 30, 2019

Improper Input Validation in simple_form

9.8 / 10

Critical

Network Low None None Unchanged High High High

Incorrect Access Control in `file_method?` in `lib/simple_form/form_builder.rb`; a user-supplied string is invoked as a method call

Impact

For pages that build a form using user input, it is possible for an attacker to manipulate the input and send any method present in the form object. For example:

<%= simple_form_for @user do |f| %>
  <%= f.label @user_supplied_string %>
  ...
<% end %>

The string provided in the variable @user_supplied_string would be invoked as a method call inside the @user object (unless the string contains any of the following: password, time_zone, country, email, phone and url).

By manipulation that input, an attacker could do any of the following:

Code execution (call actions like #destroy)
Denial of Service (by executing a computation intensive method)
Information Disclosure (check the presence of methods, leak user information)

Patches

The problem was fixed in version 5.0. Although it's a major version, there should be no issues with upgrading for 4.x. The reason it was released in a major version is that the configuration SimpleForm.file_methods was deprecated in order to fix the problem.

Workarounds

The issue only happens with pages that build forms based on user-provided input. If your application doesn't do that, you're not affected. A workaround is to explicitly pass which type you want for an input since the issue lies on Simple Form's automatically discovery of input types. This can be done using the as option, like the following:

<%= form.input :avatar, as: :file %>

References

[TDB]

For more information

If you have any questions or comments about this advisory:

Open an issue in https://github.com/plataformatec/simple_form
Email us at opensource@plataformatec.com.br

Affected versions


          0.4.0

0.5


          1.0.0


          1.0.1


          1.0.2


          1.0.3


          1.0.4


          1.1.0


          1.1.1


          1.1.2


          1.1.3


          1.2.0

+ 41 more


            1.2.1


            1.2.2


            1.3.0


            1.3.1


            1.4.0


            1.4.1


            1.4.2


            1.5.0


            1.5.1


            1.5.2


            2.0.0


            2.0.0.rc


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.1.0


            2.1.1


            2.1.2


            2.1.3


            3.0.0


            3.0.0.beta1


            3.0.0.rc


            3.0.1


            3.0.2


            3.0.3


            3.0.4


            3.1.0


            3.1.0.rc1


            3.1.0.rc2


            3.1.1


            3.2.0


            3.2.1


            3.3.0


            3.3.1


            3.4.0


            3.5.0


            3.5.1


            4.0.0


            4.0.1


            4.1.0

Fixed in


          5.0.0

References

Updated Aug 27, 2026 · Source: OSV.dev

Jul 30, 2015

2.1.3 patch

1 CVE

CVE-2019-16676 GHSA-r74q-gxcg-73hx Sep 30, 2019

Improper Input Validation in simple_form

9.8 / 10

Critical

Network Low None None Unchanged High High High

Incorrect Access Control in `file_method?` in `lib/simple_form/form_builder.rb`; a user-supplied string is invoked as a method call

Impact

For pages that build a form using user input, it is possible for an attacker to manipulate the input and send any method present in the form object. For example:

<%= simple_form_for @user do |f| %>
  <%= f.label @user_supplied_string %>
  ...
<% end %>

The string provided in the variable @user_supplied_string would be invoked as a method call inside the @user object (unless the string contains any of the following: password, time_zone, country, email, phone and url).

By manipulation that input, an attacker could do any of the following:

Code execution (call actions like #destroy)
Denial of Service (by executing a computation intensive method)
Information Disclosure (check the presence of methods, leak user information)

Patches

The problem was fixed in version 5.0. Although it's a major version, there should be no issues with upgrading for 4.x. The reason it was released in a major version is that the configuration SimpleForm.file_methods was deprecated in order to fix the problem.

Workarounds

The issue only happens with pages that build forms based on user-provided input. If your application doesn't do that, you're not affected. A workaround is to explicitly pass which type you want for an input since the issue lies on Simple Form's automatically discovery of input types. This can be done using the as option, like the following:

<%= form.input :avatar, as: :file %>

References

[TDB]

For more information

If you have any questions or comments about this advisory:

Open an issue in https://github.com/plataformatec/simple_form
Email us at opensource@plataformatec.com.br

Affected versions


          0.4.0

0.5


          1.0.0


          1.0.1


          1.0.2


          1.0.3


          1.0.4


          1.1.0


          1.1.1


          1.1.2


          1.1.3


          1.2.0

+ 41 more


            1.2.1


            1.2.2


            1.3.0


            1.3.1


            1.4.0


            1.4.1


            1.4.2


            1.5.0


            1.5.1


            1.5.2


            2.0.0


            2.0.0.rc


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.1.0


            2.1.1


            2.1.2


            2.1.3


            3.0.0


            3.0.0.beta1


            3.0.0.rc


            3.0.1


            3.0.2


            3.0.3


            3.0.4


            3.1.0


            3.1.0.rc1


            3.1.0.rc2


            3.1.1


            3.2.0


            3.2.1


            3.3.0


            3.3.1


            3.4.0


            3.5.0


            3.5.1


            4.0.0


            4.0.1


            4.1.0

Fixed in


          5.0.0

References

Updated Aug 27, 2026 · Source: OSV.dev

Jul 02, 2015

2.1.2 patch

1 CVE

CVE-2019-16676 GHSA-r74q-gxcg-73hx Sep 30, 2019

Improper Input Validation in simple_form

9.8 / 10

Critical

Network Low None None Unchanged High High High

Incorrect Access Control in `file_method?` in `lib/simple_form/form_builder.rb`; a user-supplied string is invoked as a method call

Impact

For pages that build a form using user input, it is possible for an attacker to manipulate the input and send any method present in the form object. For example:

<%= simple_form_for @user do |f| %>
  <%= f.label @user_supplied_string %>
  ...
<% end %>

The string provided in the variable @user_supplied_string would be invoked as a method call inside the @user object (unless the string contains any of the following: password, time_zone, country, email, phone and url).

By manipulation that input, an attacker could do any of the following:

Code execution (call actions like #destroy)
Denial of Service (by executing a computation intensive method)
Information Disclosure (check the presence of methods, leak user information)

Patches

The problem was fixed in version 5.0. Although it's a major version, there should be no issues with upgrading for 4.x. The reason it was released in a major version is that the configuration SimpleForm.file_methods was deprecated in order to fix the problem.

Workarounds

The issue only happens with pages that build forms based on user-provided input. If your application doesn't do that, you're not affected. A workaround is to explicitly pass which type you want for an input since the issue lies on Simple Form's automatically discovery of input types. This can be done using the as option, like the following:

<%= form.input :avatar, as: :file %>

References

[TDB]

For more information

If you have any questions or comments about this advisory:

Open an issue in https://github.com/plataformatec/simple_form
Email us at opensource@plataformatec.com.br

Affected versions


          0.4.0

0.5


          1.0.0


          1.0.1


          1.0.2


          1.0.3


          1.0.4


          1.1.0


          1.1.1


          1.1.2


          1.1.3


          1.2.0

+ 41 more


            1.2.1


            1.2.2


            1.3.0


            1.3.1


            1.4.0


            1.4.1


            1.4.2


            1.5.0


            1.5.1


            1.5.2


            2.0.0


            2.0.0.rc


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.1.0


            2.1.1


            2.1.2


            2.1.3


            3.0.0


            3.0.0.beta1


            3.0.0.rc


            3.0.1


            3.0.2


            3.0.3


            3.0.4


            3.1.0


            3.1.0.rc1


            3.1.0.rc2


            3.1.1


            3.2.0


            3.2.1


            3.3.0


            3.3.1


            3.4.0


            3.5.0


            3.5.1


            4.0.0


            4.0.1


            4.1.0

Fixed in


          5.0.0

References

Updated Aug 27, 2026 · Source: OSV.dev

Nov 25, 2014

3.1.0 minor

1 CVE

CVE-2019-16676 GHSA-r74q-gxcg-73hx Sep 30, 2019

Improper Input Validation in simple_form

9.8 / 10

Critical

Network Low None None Unchanged High High High

Incorrect Access Control in `file_method?` in `lib/simple_form/form_builder.rb`; a user-supplied string is invoked as a method call

Impact

For pages that build a form using user input, it is possible for an attacker to manipulate the input and send any method present in the form object. For example:

<%= simple_form_for @user do |f| %>
  <%= f.label @user_supplied_string %>
  ...
<% end %>

The string provided in the variable @user_supplied_string would be invoked as a method call inside the @user object (unless the string contains any of the following: password, time_zone, country, email, phone and url).

By manipulation that input, an attacker could do any of the following:

Code execution (call actions like #destroy)
Denial of Service (by executing a computation intensive method)
Information Disclosure (check the presence of methods, leak user information)

Patches

The problem was fixed in version 5.0. Although it's a major version, there should be no issues with upgrading for 4.x. The reason it was released in a major version is that the configuration SimpleForm.file_methods was deprecated in order to fix the problem.

Workarounds

The issue only happens with pages that build forms based on user-provided input. If your application doesn't do that, you're not affected. A workaround is to explicitly pass which type you want for an input since the issue lies on Simple Form's automatically discovery of input types. This can be done using the as option, like the following:

<%= form.input :avatar, as: :file %>

References

[TDB]

For more information

If you have any questions or comments about this advisory:

Open an issue in https://github.com/plataformatec/simple_form
Email us at opensource@plataformatec.com.br

Affected versions


          0.4.0

0.5


          1.0.0


          1.0.1


          1.0.2


          1.0.3


          1.0.4


          1.1.0


          1.1.1


          1.1.2


          1.1.3


          1.2.0

+ 41 more


            1.2.1


            1.2.2


            1.3.0


            1.3.1


            1.4.0


            1.4.1


            1.4.2


            1.5.0


            1.5.1


            1.5.2


            2.0.0


            2.0.0.rc


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.1.0


            2.1.1


            2.1.2


            2.1.3


            3.0.0


            3.0.0.beta1


            3.0.0.rc


            3.0.1


            3.0.2


            3.0.3


            3.0.4


            3.1.0


            3.1.0.rc1


            3.1.0.rc2


            3.1.1


            3.2.0


            3.2.1


            3.3.0


            3.3.1


            3.4.0


            3.5.0


            3.5.1


            4.0.0


            4.0.1


            4.1.0

Fixed in


          5.0.0

References

Updated Aug 27, 2026 · Source: OSV.dev

Nov 25, 2014

3.0.3 patch

1 CVE

CVE-2019-16676 GHSA-r74q-gxcg-73hx Sep 30, 2019

Improper Input Validation in simple_form

9.8 / 10

Critical

Network Low None None Unchanged High High High

Incorrect Access Control in `file_method?` in `lib/simple_form/form_builder.rb`; a user-supplied string is invoked as a method call

Impact

For pages that build a form using user input, it is possible for an attacker to manipulate the input and send any method present in the form object. For example:

<%= simple_form_for @user do |f| %>
  <%= f.label @user_supplied_string %>
  ...
<% end %>

The string provided in the variable @user_supplied_string would be invoked as a method call inside the @user object (unless the string contains any of the following: password, time_zone, country, email, phone and url).

By manipulation that input, an attacker could do any of the following:

Code execution (call actions like #destroy)
Denial of Service (by executing a computation intensive method)
Information Disclosure (check the presence of methods, leak user information)

Patches

The problem was fixed in version 5.0. Although it's a major version, there should be no issues with upgrading for 4.x. The reason it was released in a major version is that the configuration SimpleForm.file_methods was deprecated in order to fix the problem.

Workarounds

The issue only happens with pages that build forms based on user-provided input. If your application doesn't do that, you're not affected. A workaround is to explicitly pass which type you want for an input since the issue lies on Simple Form's automatically discovery of input types. This can be done using the as option, like the following:

<%= form.input :avatar, as: :file %>

References

[TDB]

For more information

If you have any questions or comments about this advisory:

Open an issue in https://github.com/plataformatec/simple_form
Email us at opensource@plataformatec.com.br

Affected versions


          0.4.0

0.5


          1.0.0


          1.0.1


          1.0.2


          1.0.3


          1.0.4


          1.1.0


          1.1.1


          1.1.2


          1.1.3


          1.2.0

+ 41 more


            1.2.1


            1.2.2


            1.3.0


            1.3.1


            1.4.0


            1.4.1


            1.4.2


            1.5.0


            1.5.1


            1.5.2


            2.0.0


            2.0.0.rc


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.1.0


            2.1.1


            2.1.2


            2.1.3


            3.0.0


            3.0.0.beta1


            3.0.0.rc


            3.0.1


            3.0.2


            3.0.3


            3.0.4


            3.1.0


            3.1.0.rc1


            3.1.0.rc2


            3.1.1


            3.2.0


            3.2.1


            3.3.0


            3.3.1


            3.4.0


            3.5.0


            3.5.1


            4.0.0


            4.0.1


            4.1.0

Fixed in


          5.0.0

References

Updated Aug 27, 2026 · Source: OSV.dev

Nov 25, 2014

3.1.0.rc2 pre

1 CVE

CVE-2019-16676 GHSA-r74q-gxcg-73hx Sep 30, 2019

Improper Input Validation in simple_form

9.8 / 10

Critical

Network Low None None Unchanged High High High

Incorrect Access Control in `file_method?` in `lib/simple_form/form_builder.rb`; a user-supplied string is invoked as a method call

Impact

For pages that build a form using user input, it is possible for an attacker to manipulate the input and send any method present in the form object. For example:

<%= simple_form_for @user do |f| %>
  <%= f.label @user_supplied_string %>
  ...
<% end %>

The string provided in the variable @user_supplied_string would be invoked as a method call inside the @user object (unless the string contains any of the following: password, time_zone, country, email, phone and url).

By manipulation that input, an attacker could do any of the following:

Code execution (call actions like #destroy)
Denial of Service (by executing a computation intensive method)
Information Disclosure (check the presence of methods, leak user information)

Patches

The problem was fixed in version 5.0. Although it's a major version, there should be no issues with upgrading for 4.x. The reason it was released in a major version is that the configuration SimpleForm.file_methods was deprecated in order to fix the problem.

Workarounds

The issue only happens with pages that build forms based on user-provided input. If your application doesn't do that, you're not affected. A workaround is to explicitly pass which type you want for an input since the issue lies on Simple Form's automatically discovery of input types. This can be done using the as option, like the following:

<%= form.input :avatar, as: :file %>

References

[TDB]

For more information

If you have any questions or comments about this advisory:

Open an issue in https://github.com/plataformatec/simple_form
Email us at opensource@plataformatec.com.br

Affected versions


          0.4.0

0.5


          1.0.0


          1.0.1


          1.0.2


          1.0.3


          1.0.4


          1.1.0


          1.1.1


          1.1.2


          1.1.3


          1.2.0

+ 41 more


            1.2.1


            1.2.2


            1.3.0


            1.3.1


            1.4.0


            1.4.1


            1.4.2


            1.5.0


            1.5.1


            1.5.2


            2.0.0


            2.0.0.rc


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.1.0


            2.1.1


            2.1.2


            2.1.3


            3.0.0


            3.0.0.beta1


            3.0.0.rc


            3.0.1


            3.0.2


            3.0.3


            3.0.4


            3.1.0


            3.1.0.rc1


            3.1.0.rc2


            3.1.1


            3.2.0


            3.2.1


            3.3.0


            3.3.1


            3.4.0


            3.5.0


            3.5.1


            4.0.0


            4.0.1


            4.1.0

Fixed in


          5.0.0

References

Updated Aug 27, 2026 · Source: OSV.dev

Jul 08, 2014

3.1.0.rc1 pre

1 CVE

CVE-2019-16676 GHSA-r74q-gxcg-73hx Sep 30, 2019

Improper Input Validation in simple_form

9.8 / 10

Critical

Network Low None None Unchanged High High High

Incorrect Access Control in `file_method?` in `lib/simple_form/form_builder.rb`; a user-supplied string is invoked as a method call

Impact

For pages that build a form using user input, it is possible for an attacker to manipulate the input and send any method present in the form object. For example:

<%= simple_form_for @user do |f| %>
  <%= f.label @user_supplied_string %>
  ...
<% end %>

The string provided in the variable @user_supplied_string would be invoked as a method call inside the @user object (unless the string contains any of the following: password, time_zone, country, email, phone and url).

By manipulation that input, an attacker could do any of the following:

Code execution (call actions like #destroy)
Denial of Service (by executing a computation intensive method)
Information Disclosure (check the presence of methods, leak user information)

Patches

The problem was fixed in version 5.0. Although it's a major version, there should be no issues with upgrading for 4.x. The reason it was released in a major version is that the configuration SimpleForm.file_methods was deprecated in order to fix the problem.

Workarounds

The issue only happens with pages that build forms based on user-provided input. If your application doesn't do that, you're not affected. A workaround is to explicitly pass which type you want for an input since the issue lies on Simple Form's automatically discovery of input types. This can be done using the as option, like the following:

<%= form.input :avatar, as: :file %>

References

[TDB]

For more information

If you have any questions or comments about this advisory:

Open an issue in https://github.com/plataformatec/simple_form
Email us at opensource@plataformatec.com.br

Affected versions


          0.4.0

0.5


          1.0.0


          1.0.1


          1.0.2


          1.0.3


          1.0.4


          1.1.0


          1.1.1


          1.1.2


          1.1.3


          1.2.0

+ 41 more


            1.2.1


            1.2.2


            1.3.0


            1.3.1


            1.4.0


            1.4.1


            1.4.2


            1.5.0


            1.5.1


            1.5.2


            2.0.0


            2.0.0.rc


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.1.0


            2.1.1


            2.1.2


            2.1.3


            3.0.0


            3.0.0.beta1


            3.0.0.rc


            3.0.1


            3.0.2


            3.0.3


            3.0.4


            3.1.0


            3.1.0.rc1


            3.1.0.rc2


            3.1.1


            3.2.0


            3.2.1


            3.3.0


            3.3.1


            3.4.0


            3.5.0


            3.5.1


            4.0.0


            4.0.1


            4.1.0

Fixed in


          5.0.0

References

Updated Aug 27, 2026 · Source: OSV.dev

Apr 14, 2014

3.0.2 patch

1 CVE

CVE-2019-16676 GHSA-r74q-gxcg-73hx Sep 30, 2019

Improper Input Validation in simple_form

9.8 / 10

Critical

Network Low None None Unchanged High High High

Incorrect Access Control in `file_method?` in `lib/simple_form/form_builder.rb`; a user-supplied string is invoked as a method call

Impact

For pages that build a form using user input, it is possible for an attacker to manipulate the input and send any method present in the form object. For example:

<%= simple_form_for @user do |f| %>
  <%= f.label @user_supplied_string %>
  ...
<% end %>

The string provided in the variable @user_supplied_string would be invoked as a method call inside the @user object (unless the string contains any of the following: password, time_zone, country, email, phone and url).

By manipulation that input, an attacker could do any of the following:

Code execution (call actions like #destroy)
Denial of Service (by executing a computation intensive method)
Information Disclosure (check the presence of methods, leak user information)

Patches

The problem was fixed in version 5.0. Although it's a major version, there should be no issues with upgrading for 4.x. The reason it was released in a major version is that the configuration SimpleForm.file_methods was deprecated in order to fix the problem.

Workarounds

The issue only happens with pages that build forms based on user-provided input. If your application doesn't do that, you're not affected. A workaround is to explicitly pass which type you want for an input since the issue lies on Simple Form's automatically discovery of input types. This can be done using the as option, like the following:

<%= form.input :avatar, as: :file %>

References

[TDB]

For more information

If you have any questions or comments about this advisory:

Open an issue in https://github.com/plataformatec/simple_form
Email us at opensource@plataformatec.com.br

Affected versions


          0.4.0

0.5


          1.0.0


          1.0.1


          1.0.2


          1.0.3


          1.0.4


          1.1.0


          1.1.1


          1.1.2


          1.1.3


          1.2.0

+ 41 more


            1.2.1


            1.2.2


            1.3.0


            1.3.1


            1.4.0


            1.4.1


            1.4.2


            1.5.0


            1.5.1


            1.5.2


            2.0.0


            2.0.0.rc


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.1.0


            2.1.1


            2.1.2


            2.1.3


            3.0.0


            3.0.0.beta1


            3.0.0.rc


            3.0.1


            3.0.2


            3.0.3


            3.0.4


            3.1.0


            3.1.0.rc1


            3.1.0.rc2


            3.1.1


            3.2.0


            3.2.1


            3.3.0


            3.3.1


            3.4.0


            3.5.0


            3.5.1


            4.0.0


            4.0.1


            4.1.0

Fixed in


          5.0.0

References

Updated Aug 27, 2026 · Source: OSV.dev

Apr 09, 2014

2.1.1 patch

1 CVE

CVE-2019-16676 GHSA-r74q-gxcg-73hx Sep 30, 2019

Improper Input Validation in simple_form

9.8 / 10

Critical

Network Low None None Unchanged High High High

Incorrect Access Control in `file_method?` in `lib/simple_form/form_builder.rb`; a user-supplied string is invoked as a method call

Impact

For pages that build a form using user input, it is possible for an attacker to manipulate the input and send any method present in the form object. For example:

<%= simple_form_for @user do |f| %>
  <%= f.label @user_supplied_string %>
  ...
<% end %>

The string provided in the variable @user_supplied_string would be invoked as a method call inside the @user object (unless the string contains any of the following: password, time_zone, country, email, phone and url).

By manipulation that input, an attacker could do any of the following:

Code execution (call actions like #destroy)
Denial of Service (by executing a computation intensive method)
Information Disclosure (check the presence of methods, leak user information)

Patches

The problem was fixed in version 5.0. Although it's a major version, there should be no issues with upgrading for 4.x. The reason it was released in a major version is that the configuration SimpleForm.file_methods was deprecated in order to fix the problem.

Workarounds

The issue only happens with pages that build forms based on user-provided input. If your application doesn't do that, you're not affected. A workaround is to explicitly pass which type you want for an input since the issue lies on Simple Form's automatically discovery of input types. This can be done using the as option, like the following:

<%= form.input :avatar, as: :file %>

References

[TDB]

For more information

If you have any questions or comments about this advisory:

Open an issue in https://github.com/plataformatec/simple_form
Email us at opensource@plataformatec.com.br

Affected versions


          0.4.0

0.5


          1.0.0


          1.0.1


          1.0.2


          1.0.3


          1.0.4


          1.1.0


          1.1.1


          1.1.2


          1.1.3


          1.2.0

+ 41 more


            1.2.1


            1.2.2


            1.3.0


            1.3.1


            1.4.0


            1.4.1


            1.4.2


            1.5.0


            1.5.1


            1.5.2


            2.0.0


            2.0.0.rc


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.1.0


            2.1.1


            2.1.2


            2.1.3


            3.0.0


            3.0.0.beta1


            3.0.0.rc


            3.0.1


            3.0.2


            3.0.3


            3.0.4


            3.1.0


            3.1.0.rc1


            3.1.0.rc2


            3.1.1


            3.2.0


            3.2.1


            3.3.0


            3.3.1


            3.4.0


            3.5.0


            3.5.1


            4.0.0


            4.0.1


            4.1.0

Fixed in


          5.0.0

References

Updated Aug 27, 2026 · Source: OSV.dev

Nov 29, 2013

3.0.1 patch

1 CVE

CVE-2019-16676 GHSA-r74q-gxcg-73hx Sep 30, 2019

Improper Input Validation in simple_form

9.8 / 10

Critical

Network Low None None Unchanged High High High

Incorrect Access Control in `file_method?` in `lib/simple_form/form_builder.rb`; a user-supplied string is invoked as a method call

Impact

For pages that build a form using user input, it is possible for an attacker to manipulate the input and send any method present in the form object. For example:

<%= simple_form_for @user do |f| %>
  <%= f.label @user_supplied_string %>
  ...
<% end %>

The string provided in the variable @user_supplied_string would be invoked as a method call inside the @user object (unless the string contains any of the following: password, time_zone, country, email, phone and url).

By manipulation that input, an attacker could do any of the following:

Code execution (call actions like #destroy)
Denial of Service (by executing a computation intensive method)
Information Disclosure (check the presence of methods, leak user information)

Patches

The problem was fixed in version 5.0. Although it's a major version, there should be no issues with upgrading for 4.x. The reason it was released in a major version is that the configuration SimpleForm.file_methods was deprecated in order to fix the problem.

Workarounds

The issue only happens with pages that build forms based on user-provided input. If your application doesn't do that, you're not affected. A workaround is to explicitly pass which type you want for an input since the issue lies on Simple Form's automatically discovery of input types. This can be done using the as option, like the following:

<%= form.input :avatar, as: :file %>

References

[TDB]

For more information

If you have any questions or comments about this advisory:

Open an issue in https://github.com/plataformatec/simple_form
Email us at opensource@plataformatec.com.br

Affected versions


          0.4.0

0.5


          1.0.0


          1.0.1


          1.0.2


          1.0.3


          1.0.4


          1.1.0


          1.1.1


          1.1.2


          1.1.3


          1.2.0

+ 41 more


            1.2.1


            1.2.2


            1.3.0


            1.3.1


            1.4.0


            1.4.1


            1.4.2


            1.5.0


            1.5.1


            1.5.2


            2.0.0


            2.0.0.rc


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.1.0


            2.1.1


            2.1.2


            2.1.3


            3.0.0


            3.0.0.beta1


            3.0.0.rc


            3.0.1


            3.0.2


            3.0.3


            3.0.4


            3.1.0


            3.1.0.rc1


            3.1.0.rc2


            3.1.1


            3.2.0


            3.2.1


            3.3.0


            3.3.1


            3.4.0


            3.5.0


            3.5.1


            4.0.0


            4.0.1


            4.1.0

Fixed in


          5.0.0

References

Updated Aug 27, 2026 · Source: OSV.dev

Nov 29, 2013

3.0.0 major

1 CVE

CVE-2019-16676 GHSA-r74q-gxcg-73hx Sep 30, 2019

Improper Input Validation in simple_form

9.8 / 10

Critical

Network Low None None Unchanged High High High

Incorrect Access Control in `file_method?` in `lib/simple_form/form_builder.rb`; a user-supplied string is invoked as a method call

Impact

For pages that build a form using user input, it is possible for an attacker to manipulate the input and send any method present in the form object. For example:

<%= simple_form_for @user do |f| %>
  <%= f.label @user_supplied_string %>
  ...
<% end %>

The string provided in the variable @user_supplied_string would be invoked as a method call inside the @user object (unless the string contains any of the following: password, time_zone, country, email, phone and url).

By manipulation that input, an attacker could do any of the following:

Code execution (call actions like #destroy)
Denial of Service (by executing a computation intensive method)
Information Disclosure (check the presence of methods, leak user information)

Patches

The problem was fixed in version 5.0. Although it's a major version, there should be no issues with upgrading for 4.x. The reason it was released in a major version is that the configuration SimpleForm.file_methods was deprecated in order to fix the problem.

Workarounds

The issue only happens with pages that build forms based on user-provided input. If your application doesn't do that, you're not affected. A workaround is to explicitly pass which type you want for an input since the issue lies on Simple Form's automatically discovery of input types. This can be done using the as option, like the following:

<%= form.input :avatar, as: :file %>

References

[TDB]

For more information

If you have any questions or comments about this advisory:

Open an issue in https://github.com/plataformatec/simple_form
Email us at opensource@plataformatec.com.br

Affected versions


          0.4.0

0.5


          1.0.0


          1.0.1


          1.0.2


          1.0.3


          1.0.4


          1.1.0


          1.1.1


          1.1.2


          1.1.3


          1.2.0

+ 41 more


            1.2.1


            1.2.2


            1.3.0


            1.3.1


            1.4.0


            1.4.1


            1.4.2


            1.5.0


            1.5.1


            1.5.2


            2.0.0


            2.0.0.rc


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.1.0


            2.1.1


            2.1.2


            2.1.3


            3.0.0


            3.0.0.beta1


            3.0.0.rc


            3.0.1


            3.0.2


            3.0.3


            3.0.4


            3.1.0


            3.1.0.rc1


            3.1.0.rc2


            3.1.1


            3.2.0


            3.2.1


            3.3.0


            3.3.1


            3.4.0


            3.5.0


            3.5.1


            4.0.0


            4.0.1


            4.1.0

Fixed in


          5.0.0

References

Updated Aug 27, 2026 · Source: OSV.dev

Sep 21, 2013

3.0.0.rc pre

1 CVE

CVE-2019-16676 GHSA-r74q-gxcg-73hx Sep 30, 2019

Improper Input Validation in simple_form

9.8 / 10

Critical

Network Low None None Unchanged High High High

Incorrect Access Control in `file_method?` in `lib/simple_form/form_builder.rb`; a user-supplied string is invoked as a method call

Impact

For pages that build a form using user input, it is possible for an attacker to manipulate the input and send any method present in the form object. For example:

<%= simple_form_for @user do |f| %>
  <%= f.label @user_supplied_string %>
  ...
<% end %>

The string provided in the variable @user_supplied_string would be invoked as a method call inside the @user object (unless the string contains any of the following: password, time_zone, country, email, phone and url).

By manipulation that input, an attacker could do any of the following:

Code execution (call actions like #destroy)
Denial of Service (by executing a computation intensive method)
Information Disclosure (check the presence of methods, leak user information)

Patches

The problem was fixed in version 5.0. Although it's a major version, there should be no issues with upgrading for 4.x. The reason it was released in a major version is that the configuration SimpleForm.file_methods was deprecated in order to fix the problem.

Workarounds

The issue only happens with pages that build forms based on user-provided input. If your application doesn't do that, you're not affected. A workaround is to explicitly pass which type you want for an input since the issue lies on Simple Form's automatically discovery of input types. This can be done using the as option, like the following:

<%= form.input :avatar, as: :file %>

References

[TDB]

For more information

If you have any questions or comments about this advisory:

Open an issue in https://github.com/plataformatec/simple_form
Email us at opensource@plataformatec.com.br

Affected versions


          0.4.0

0.5


          1.0.0


          1.0.1


          1.0.2


          1.0.3


          1.0.4


          1.1.0


          1.1.1


          1.1.2


          1.1.3


          1.2.0

+ 41 more


            1.2.1


            1.2.2


            1.3.0


            1.3.1


            1.4.0


            1.4.1


            1.4.2


            1.5.0


            1.5.1


            1.5.2


            2.0.0


            2.0.0.rc


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.1.0


            2.1.1


            2.1.2


            2.1.3


            3.0.0


            3.0.0.beta1


            3.0.0.rc


            3.0.1


            3.0.2


            3.0.3


            3.0.4


            3.1.0


            3.1.0.rc1


            3.1.0.rc2


            3.1.1


            3.2.0


            3.2.1


            3.3.0


            3.3.1


            3.4.0


            3.5.0


            3.5.1


            4.0.0


            4.0.1


            4.1.0

Fixed in


          5.0.0

References

Updated Aug 27, 2026 · Source: OSV.dev

May 10, 2013

2.1.0 minor

1 CVE

CVE-2019-16676 GHSA-r74q-gxcg-73hx Sep 30, 2019

Improper Input Validation in simple_form

9.8 / 10

Critical

Network Low None None Unchanged High High High

Incorrect Access Control in `file_method?` in `lib/simple_form/form_builder.rb`; a user-supplied string is invoked as a method call

Impact

For pages that build a form using user input, it is possible for an attacker to manipulate the input and send any method present in the form object. For example:

<%= simple_form_for @user do |f| %>
  <%= f.label @user_supplied_string %>
  ...
<% end %>

The string provided in the variable @user_supplied_string would be invoked as a method call inside the @user object (unless the string contains any of the following: password, time_zone, country, email, phone and url).

By manipulation that input, an attacker could do any of the following:

Code execution (call actions like #destroy)
Denial of Service (by executing a computation intensive method)
Information Disclosure (check the presence of methods, leak user information)

Patches

The problem was fixed in version 5.0. Although it's a major version, there should be no issues with upgrading for 4.x. The reason it was released in a major version is that the configuration SimpleForm.file_methods was deprecated in order to fix the problem.

Workarounds

The issue only happens with pages that build forms based on user-provided input. If your application doesn't do that, you're not affected. A workaround is to explicitly pass which type you want for an input since the issue lies on Simple Form's automatically discovery of input types. This can be done using the as option, like the following:

<%= form.input :avatar, as: :file %>

References

[TDB]

For more information

If you have any questions or comments about this advisory:

Open an issue in https://github.com/plataformatec/simple_form
Email us at opensource@plataformatec.com.br

Affected versions


          0.4.0

0.5


          1.0.0


          1.0.1


          1.0.2


          1.0.3


          1.0.4


          1.1.0


          1.1.1


          1.1.2


          1.1.3


          1.2.0

+ 41 more


            1.2.1


            1.2.2


            1.3.0


            1.3.1


            1.4.0


            1.4.1


            1.4.2


            1.5.0


            1.5.1


            1.5.2


            2.0.0


            2.0.0.rc


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.1.0


            2.1.1


            2.1.2


            2.1.3


            3.0.0


            3.0.0.beta1


            3.0.0.rc


            3.0.1


            3.0.2


            3.0.3


            3.0.4


            3.1.0


            3.1.0.rc1


            3.1.0.rc2


            3.1.1


            3.2.0


            3.2.1


            3.3.0


            3.3.1


            3.4.0


            3.5.0


            3.5.1


            4.0.0


            4.0.1


            4.1.0

Fixed in


          5.0.0

References

Updated Aug 27, 2026 · Source: OSV.dev

Feb 26, 2013

3.0.0.beta1 pre

1 CVE

CVE-2019-16676 GHSA-r74q-gxcg-73hx Sep 30, 2019

Improper Input Validation in simple_form

9.8 / 10

Critical

Network Low None None Unchanged High High High

Incorrect Access Control in `file_method?` in `lib/simple_form/form_builder.rb`; a user-supplied string is invoked as a method call

Impact

For pages that build a form using user input, it is possible for an attacker to manipulate the input and send any method present in the form object. For example:

<%= simple_form_for @user do |f| %>
  <%= f.label @user_supplied_string %>
  ...
<% end %>

The string provided in the variable @user_supplied_string would be invoked as a method call inside the @user object (unless the string contains any of the following: password, time_zone, country, email, phone and url).

By manipulation that input, an attacker could do any of the following:

Code execution (call actions like #destroy)
Denial of Service (by executing a computation intensive method)
Information Disclosure (check the presence of methods, leak user information)

Patches

The problem was fixed in version 5.0. Although it's a major version, there should be no issues with upgrading for 4.x. The reason it was released in a major version is that the configuration SimpleForm.file_methods was deprecated in order to fix the problem.

Workarounds

The issue only happens with pages that build forms based on user-provided input. If your application doesn't do that, you're not affected. A workaround is to explicitly pass which type you want for an input since the issue lies on Simple Form's automatically discovery of input types. This can be done using the as option, like the following:

<%= form.input :avatar, as: :file %>

References

[TDB]

For more information

If you have any questions or comments about this advisory:

Open an issue in https://github.com/plataformatec/simple_form
Email us at opensource@plataformatec.com.br

Affected versions


          0.4.0

0.5


          1.0.0


          1.0.1


          1.0.2


          1.0.3


          1.0.4


          1.1.0


          1.1.1


          1.1.2


          1.1.3


          1.2.0

+ 41 more


            1.2.1


            1.2.2


            1.3.0


            1.3.1


            1.4.0


            1.4.1


            1.4.2


            1.5.0


            1.5.1


            1.5.2


            2.0.0


            2.0.0.rc


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.1.0


            2.1.1


            2.1.2


            2.1.3


            3.0.0


            3.0.0.beta1


            3.0.0.rc


            3.0.1


            3.0.2


            3.0.3


            3.0.4


            3.1.0


            3.1.0.rc1


            3.1.0.rc2


            3.1.1


            3.2.0


            3.2.1


            3.3.0


            3.3.1


            3.4.0


            3.5.0


            3.5.1


            4.0.0


            4.0.1


            4.1.0

Fixed in


          5.0.0

References

Updated Aug 27, 2026 · Source: OSV.dev

Feb 26, 2013

2.0.4 patch

1 CVE

CVE-2019-16676 GHSA-r74q-gxcg-73hx Sep 30, 2019

Improper Input Validation in simple_form

9.8 / 10

Critical

Network Low None None Unchanged High High High

Incorrect Access Control in `file_method?` in `lib/simple_form/form_builder.rb`; a user-supplied string is invoked as a method call

Impact

For pages that build a form using user input, it is possible for an attacker to manipulate the input and send any method present in the form object. For example:

<%= simple_form_for @user do |f| %>
  <%= f.label @user_supplied_string %>
  ...
<% end %>

The string provided in the variable @user_supplied_string would be invoked as a method call inside the @user object (unless the string contains any of the following: password, time_zone, country, email, phone and url).

By manipulation that input, an attacker could do any of the following:

Code execution (call actions like #destroy)
Denial of Service (by executing a computation intensive method)
Information Disclosure (check the presence of methods, leak user information)

Patches

The problem was fixed in version 5.0. Although it's a major version, there should be no issues with upgrading for 4.x. The reason it was released in a major version is that the configuration SimpleForm.file_methods was deprecated in order to fix the problem.

Workarounds

The issue only happens with pages that build forms based on user-provided input. If your application doesn't do that, you're not affected. A workaround is to explicitly pass which type you want for an input since the issue lies on Simple Form's automatically discovery of input types. This can be done using the as option, like the following:

<%= form.input :avatar, as: :file %>

References

[TDB]

For more information

If you have any questions or comments about this advisory:

Open an issue in https://github.com/plataformatec/simple_form
Email us at opensource@plataformatec.com.br

Affected versions


          0.4.0

0.5


          1.0.0


          1.0.1


          1.0.2


          1.0.3


          1.0.4


          1.1.0


          1.1.1


          1.1.2


          1.1.3


          1.2.0

+ 41 more


            1.2.1


            1.2.2


            1.3.0


            1.3.1


            1.4.0


            1.4.1


            1.4.2


            1.5.0


            1.5.1


            1.5.2


            2.0.0


            2.0.0.rc


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.1.0


            2.1.1


            2.1.2


            2.1.3


            3.0.0


            3.0.0.beta1


            3.0.0.rc


            3.0.1


            3.0.2


            3.0.3


            3.0.4


            3.1.0


            3.1.0.rc1


            3.1.0.rc2


            3.1.1


            3.2.0


            3.2.1


            3.3.0


            3.3.1


            3.4.0


            3.5.0


            3.5.1


            4.0.0


            4.0.1


            4.1.0

Fixed in


          5.0.0

References

Updated Aug 27, 2026 · Source: OSV.dev

Oct 08, 2012

2.0.3 patch

1 CVE

CVE-2019-16676 GHSA-r74q-gxcg-73hx Sep 30, 2019

Improper Input Validation in simple_form

9.8 / 10

Critical

Network Low None None Unchanged High High High

Incorrect Access Control in `file_method?` in `lib/simple_form/form_builder.rb`; a user-supplied string is invoked as a method call

Impact

For pages that build a form using user input, it is possible for an attacker to manipulate the input and send any method present in the form object. For example:

<%= simple_form_for @user do |f| %>
  <%= f.label @user_supplied_string %>
  ...
<% end %>

The string provided in the variable @user_supplied_string would be invoked as a method call inside the @user object (unless the string contains any of the following: password, time_zone, country, email, phone and url).

By manipulation that input, an attacker could do any of the following:

Code execution (call actions like #destroy)
Denial of Service (by executing a computation intensive method)
Information Disclosure (check the presence of methods, leak user information)

Patches

The problem was fixed in version 5.0. Although it's a major version, there should be no issues with upgrading for 4.x. The reason it was released in a major version is that the configuration SimpleForm.file_methods was deprecated in order to fix the problem.

Workarounds

The issue only happens with pages that build forms based on user-provided input. If your application doesn't do that, you're not affected. A workaround is to explicitly pass which type you want for an input since the issue lies on Simple Form's automatically discovery of input types. This can be done using the as option, like the following:

<%= form.input :avatar, as: :file %>

References

[TDB]

For more information

If you have any questions or comments about this advisory:

Open an issue in https://github.com/plataformatec/simple_form
Email us at opensource@plataformatec.com.br

Affected versions


          0.4.0

0.5


          1.0.0


          1.0.1


          1.0.2


          1.0.3


          1.0.4


          1.1.0


          1.1.1


          1.1.2


          1.1.3


          1.2.0

+ 41 more


            1.2.1


            1.2.2


            1.3.0


            1.3.1


            1.4.0


            1.4.1


            1.4.2


            1.5.0


            1.5.1


            1.5.2


            2.0.0


            2.0.0.rc


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.1.0


            2.1.1


            2.1.2


            2.1.3


            3.0.0


            3.0.0.beta1


            3.0.0.rc


            3.0.1


            3.0.2


            3.0.3


            3.0.4


            3.1.0


            3.1.0.rc1


            3.1.0.rc2


            3.1.1


            3.2.0


            3.2.1


            3.3.0


            3.3.1


            3.4.0


            3.5.0


            3.5.1


            4.0.0


            4.0.1


            4.1.0

Fixed in


          5.0.0

References

Updated Aug 27, 2026 · Source: OSV.dev

Sep 27, 2012

2.0.2 patch

1 CVE

CVE-2019-16676 GHSA-r74q-gxcg-73hx Sep 30, 2019

Improper Input Validation in simple_form

9.8 / 10

Critical

Network Low None None Unchanged High High High

Incorrect Access Control in `file_method?` in `lib/simple_form/form_builder.rb`; a user-supplied string is invoked as a method call

Impact

For pages that build a form using user input, it is possible for an attacker to manipulate the input and send any method present in the form object. For example:

<%= simple_form_for @user do |f| %>
  <%= f.label @user_supplied_string %>
  ...
<% end %>

The string provided in the variable @user_supplied_string would be invoked as a method call inside the @user object (unless the string contains any of the following: password, time_zone, country, email, phone and url).

By manipulation that input, an attacker could do any of the following:

Code execution (call actions like #destroy)
Denial of Service (by executing a computation intensive method)
Information Disclosure (check the presence of methods, leak user information)

Patches

The problem was fixed in version 5.0. Although it's a major version, there should be no issues with upgrading for 4.x. The reason it was released in a major version is that the configuration SimpleForm.file_methods was deprecated in order to fix the problem.

Workarounds

The issue only happens with pages that build forms based on user-provided input. If your application doesn't do that, you're not affected. A workaround is to explicitly pass which type you want for an input since the issue lies on Simple Form's automatically discovery of input types. This can be done using the as option, like the following:

<%= form.input :avatar, as: :file %>

References

[TDB]

For more information

If you have any questions or comments about this advisory:

Open an issue in https://github.com/plataformatec/simple_form
Email us at opensource@plataformatec.com.br

Affected versions


          0.4.0

0.5


          1.0.0


          1.0.1


          1.0.2


          1.0.3


          1.0.4


          1.1.0


          1.1.1


          1.1.2


          1.1.3


          1.2.0

+ 41 more


            1.2.1


            1.2.2


            1.3.0


            1.3.1


            1.4.0


            1.4.1


            1.4.2


            1.5.0


            1.5.1


            1.5.2


            2.0.0


            2.0.0.rc


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.1.0


            2.1.1


            2.1.2


            2.1.3


            3.0.0


            3.0.0.beta1


            3.0.0.rc


            3.0.1


            3.0.2


            3.0.3


            3.0.4


            3.1.0


            3.1.0.rc1


            3.1.0.rc2


            3.1.1


            3.2.0


            3.2.1


            3.3.0


            3.3.1


            3.4.0


            3.5.0


            3.5.1


            4.0.0


            4.0.1


            4.1.0

Fixed in


          5.0.0

References

Updated Aug 27, 2026 · Source: OSV.dev

Apr 30, 2012

2.0.1 patch

1 CVE

CVE-2019-16676 GHSA-r74q-gxcg-73hx Sep 30, 2019

Improper Input Validation in simple_form

9.8 / 10

Critical

Network Low None None Unchanged High High High

Incorrect Access Control in `file_method?` in `lib/simple_form/form_builder.rb`; a user-supplied string is invoked as a method call

Impact

For pages that build a form using user input, it is possible for an attacker to manipulate the input and send any method present in the form object. For example:

<%= simple_form_for @user do |f| %>
  <%= f.label @user_supplied_string %>
  ...
<% end %>

The string provided in the variable @user_supplied_string would be invoked as a method call inside the @user object (unless the string contains any of the following: password, time_zone, country, email, phone and url).

By manipulation that input, an attacker could do any of the following:

Code execution (call actions like #destroy)
Denial of Service (by executing a computation intensive method)
Information Disclosure (check the presence of methods, leak user information)

Patches

The problem was fixed in version 5.0. Although it's a major version, there should be no issues with upgrading for 4.x. The reason it was released in a major version is that the configuration SimpleForm.file_methods was deprecated in order to fix the problem.

Workarounds

The issue only happens with pages that build forms based on user-provided input. If your application doesn't do that, you're not affected. A workaround is to explicitly pass which type you want for an input since the issue lies on Simple Form's automatically discovery of input types. This can be done using the as option, like the following:

<%= form.input :avatar, as: :file %>

References

[TDB]

For more information

If you have any questions or comments about this advisory:

Open an issue in https://github.com/plataformatec/simple_form
Email us at opensource@plataformatec.com.br

Affected versions


          0.4.0

0.5


          1.0.0


          1.0.1


          1.0.2


          1.0.3


          1.0.4


          1.1.0


          1.1.1


          1.1.2


          1.1.3


          1.2.0

+ 41 more


            1.2.1


            1.2.2


            1.3.0


            1.3.1


            1.4.0


            1.4.1


            1.4.2


            1.5.0


            1.5.1


            1.5.2


            2.0.0


            2.0.0.rc


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.1.0


            2.1.1


            2.1.2


            2.1.3


            3.0.0


            3.0.0.beta1


            3.0.0.rc


            3.0.1


            3.0.2


            3.0.3


            3.0.4


            3.1.0


            3.1.0.rc1


            3.1.0.rc2


            3.1.1


            3.2.0


            3.2.1


            3.3.0


            3.3.1


            3.4.0


            3.5.0


            3.5.1


            4.0.0


            4.0.1


            4.1.0

Fixed in


          5.0.0

References

Updated Aug 27, 2026 · Source: OSV.dev

Feb 27, 2012

2.0.0 major

1 CVE

CVE-2019-16676 GHSA-r74q-gxcg-73hx Sep 30, 2019

Improper Input Validation in simple_form

9.8 / 10

Critical

Network Low None None Unchanged High High High

Incorrect Access Control in `file_method?` in `lib/simple_form/form_builder.rb`; a user-supplied string is invoked as a method call

Impact

For pages that build a form using user input, it is possible for an attacker to manipulate the input and send any method present in the form object. For example:

<%= simple_form_for @user do |f| %>
  <%= f.label @user_supplied_string %>
  ...
<% end %>

The string provided in the variable @user_supplied_string would be invoked as a method call inside the @user object (unless the string contains any of the following: password, time_zone, country, email, phone and url).

By manipulation that input, an attacker could do any of the following:

Code execution (call actions like #destroy)
Denial of Service (by executing a computation intensive method)
Information Disclosure (check the presence of methods, leak user information)

Patches

The problem was fixed in version 5.0. Although it's a major version, there should be no issues with upgrading for 4.x. The reason it was released in a major version is that the configuration SimpleForm.file_methods was deprecated in order to fix the problem.

Workarounds

The issue only happens with pages that build forms based on user-provided input. If your application doesn't do that, you're not affected. A workaround is to explicitly pass which type you want for an input since the issue lies on Simple Form's automatically discovery of input types. This can be done using the as option, like the following:

<%= form.input :avatar, as: :file %>

References

[TDB]

For more information

If you have any questions or comments about this advisory:

Open an issue in https://github.com/plataformatec/simple_form
Email us at opensource@plataformatec.com.br

Affected versions


          0.4.0

0.5


          1.0.0


          1.0.1


          1.0.2


          1.0.3


          1.0.4


          1.1.0


          1.1.1


          1.1.2


          1.1.3


          1.2.0

+ 41 more


            1.2.1


            1.2.2


            1.3.0


            1.3.1


            1.4.0


            1.4.1


            1.4.2


            1.5.0


            1.5.1


            1.5.2


            2.0.0


            2.0.0.rc


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.1.0


            2.1.1


            2.1.2


            2.1.3


            3.0.0


            3.0.0.beta1


            3.0.0.rc


            3.0.1


            3.0.2


            3.0.3


            3.0.4


            3.1.0


            3.1.0.rc1


            3.1.0.rc2


            3.1.1


            3.2.0


            3.2.1


            3.3.0


            3.3.1


            3.4.0


            3.5.0


            3.5.1


            4.0.0


            4.0.1


            4.1.0

Fixed in


          5.0.0

References

Updated Aug 27, 2026 · Source: OSV.dev

Feb 23, 2012

2.0.0.rc pre

1 CVE

CVE-2019-16676 GHSA-r74q-gxcg-73hx Sep 30, 2019

Improper Input Validation in simple_form

9.8 / 10

Critical

Network Low None None Unchanged High High High

Incorrect Access Control in `file_method?` in `lib/simple_form/form_builder.rb`; a user-supplied string is invoked as a method call

Impact

For pages that build a form using user input, it is possible for an attacker to manipulate the input and send any method present in the form object. For example:

<%= simple_form_for @user do |f| %>
  <%= f.label @user_supplied_string %>
  ...
<% end %>

The string provided in the variable @user_supplied_string would be invoked as a method call inside the @user object (unless the string contains any of the following: password, time_zone, country, email, phone and url).

By manipulation that input, an attacker could do any of the following:

Code execution (call actions like #destroy)
Denial of Service (by executing a computation intensive method)
Information Disclosure (check the presence of methods, leak user information)

Patches

The problem was fixed in version 5.0. Although it's a major version, there should be no issues with upgrading for 4.x. The reason it was released in a major version is that the configuration SimpleForm.file_methods was deprecated in order to fix the problem.

Workarounds

The issue only happens with pages that build forms based on user-provided input. If your application doesn't do that, you're not affected. A workaround is to explicitly pass which type you want for an input since the issue lies on Simple Form's automatically discovery of input types. This can be done using the as option, like the following:

<%= form.input :avatar, as: :file %>

References

[TDB]

For more information

If you have any questions or comments about this advisory:

Open an issue in https://github.com/plataformatec/simple_form
Email us at opensource@plataformatec.com.br

Affected versions


          0.4.0

0.5


          1.0.0


          1.0.1


          1.0.2


          1.0.3


          1.0.4


          1.1.0


          1.1.1


          1.1.2


          1.1.3


          1.2.0

+ 41 more


            1.2.1


            1.2.2


            1.3.0


            1.3.1


            1.4.0


            1.4.1


            1.4.2


            1.5.0


            1.5.1


            1.5.2


            2.0.0


            2.0.0.rc


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.1.0


            2.1.1


            2.1.2


            2.1.3


            3.0.0


            3.0.0.beta1


            3.0.0.rc


            3.0.1


            3.0.2


            3.0.3


            3.0.4


            3.1.0


            3.1.0.rc1


            3.1.0.rc2


            3.1.1


            3.2.0


            3.2.1


            3.3.0


            3.3.1


            3.4.0


            3.5.0


            3.5.1


            4.0.0


            4.0.1


            4.1.0

Fixed in


          5.0.0

References

Updated Aug 27, 2026 · Source: OSV.dev

Feb 01, 2012

1.5.2 patch

1 CVE

CVE-2019-16676 GHSA-r74q-gxcg-73hx Sep 30, 2019

Improper Input Validation in simple_form

9.8 / 10

Critical

Network Low None None Unchanged High High High

Incorrect Access Control in `file_method?` in `lib/simple_form/form_builder.rb`; a user-supplied string is invoked as a method call

Impact

For pages that build a form using user input, it is possible for an attacker to manipulate the input and send any method present in the form object. For example:

<%= simple_form_for @user do |f| %>
  <%= f.label @user_supplied_string %>
  ...
<% end %>

The string provided in the variable @user_supplied_string would be invoked as a method call inside the @user object (unless the string contains any of the following: password, time_zone, country, email, phone and url).

By manipulation that input, an attacker could do any of the following:

Code execution (call actions like #destroy)
Denial of Service (by executing a computation intensive method)
Information Disclosure (check the presence of methods, leak user information)

Patches

The problem was fixed in version 5.0. Although it's a major version, there should be no issues with upgrading for 4.x. The reason it was released in a major version is that the configuration SimpleForm.file_methods was deprecated in order to fix the problem.

Workarounds

The issue only happens with pages that build forms based on user-provided input. If your application doesn't do that, you're not affected. A workaround is to explicitly pass which type you want for an input since the issue lies on Simple Form's automatically discovery of input types. This can be done using the as option, like the following:

<%= form.input :avatar, as: :file %>

References

[TDB]

For more information

If you have any questions or comments about this advisory:

Open an issue in https://github.com/plataformatec/simple_form
Email us at opensource@plataformatec.com.br

Affected versions


          0.4.0

0.5


          1.0.0


          1.0.1


          1.0.2


          1.0.3


          1.0.4


          1.1.0


          1.1.1


          1.1.2


          1.1.3


          1.2.0

+ 41 more


            1.2.1


            1.2.2


            1.3.0


            1.3.1


            1.4.0


            1.4.1


            1.4.2


            1.5.0


            1.5.1


            1.5.2


            2.0.0


            2.0.0.rc


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.1.0


            2.1.1


            2.1.2


            2.1.3


            3.0.0


            3.0.0.beta1


            3.0.0.rc


            3.0.1


            3.0.2


            3.0.3


            3.0.4


            3.1.0


            3.1.0.rc1


            3.1.0.rc2


            3.1.1


            3.2.0


            3.2.1


            3.3.0


            3.3.1


            3.4.0


            3.5.0


            3.5.1


            4.0.0


            4.0.1


            4.1.0

Fixed in


          5.0.0

References

Updated Aug 27, 2026 · Source: OSV.dev

Sep 23, 2011

1.5.1 patch

1 CVE

CVE-2019-16676 GHSA-r74q-gxcg-73hx Sep 30, 2019

Improper Input Validation in simple_form

9.8 / 10

Critical

Network Low None None Unchanged High High High

Incorrect Access Control in `file_method?` in `lib/simple_form/form_builder.rb`; a user-supplied string is invoked as a method call

Impact

For pages that build a form using user input, it is possible for an attacker to manipulate the input and send any method present in the form object. For example:

<%= simple_form_for @user do |f| %>
  <%= f.label @user_supplied_string %>
  ...
<% end %>

The string provided in the variable @user_supplied_string would be invoked as a method call inside the @user object (unless the string contains any of the following: password, time_zone, country, email, phone and url).

By manipulation that input, an attacker could do any of the following:

Code execution (call actions like #destroy)
Denial of Service (by executing a computation intensive method)
Information Disclosure (check the presence of methods, leak user information)

Patches

The problem was fixed in version 5.0. Although it's a major version, there should be no issues with upgrading for 4.x. The reason it was released in a major version is that the configuration SimpleForm.file_methods was deprecated in order to fix the problem.

Workarounds

The issue only happens with pages that build forms based on user-provided input. If your application doesn't do that, you're not affected. A workaround is to explicitly pass which type you want for an input since the issue lies on Simple Form's automatically discovery of input types. This can be done using the as option, like the following:

<%= form.input :avatar, as: :file %>

References

[TDB]

For more information

If you have any questions or comments about this advisory:

Open an issue in https://github.com/plataformatec/simple_form
Email us at opensource@plataformatec.com.br

Affected versions


          0.4.0

0.5


          1.0.0


          1.0.1


          1.0.2


          1.0.3


          1.0.4


          1.1.0


          1.1.1


          1.1.2


          1.1.3


          1.2.0

+ 41 more


            1.2.1


            1.2.2


            1.3.0


            1.3.1


            1.4.0


            1.4.1


            1.4.2


            1.5.0


            1.5.1


            1.5.2


            2.0.0


            2.0.0.rc


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.1.0


            2.1.1


            2.1.2


            2.1.3


            3.0.0


            3.0.0.beta1


            3.0.0.rc


            3.0.1


            3.0.2


            3.0.3


            3.0.4


            3.1.0


            3.1.0.rc1


            3.1.0.rc2


            3.1.1


            3.2.0


            3.2.1


            3.3.0


            3.3.1


            3.4.0


            3.5.0


            3.5.1


            4.0.0


            4.0.1


            4.1.0

Fixed in


          5.0.0

References

Updated Aug 27, 2026 · Source: OSV.dev

Sep 15, 2011

1.5.0 minor

1 CVE

CVE-2019-16676 GHSA-r74q-gxcg-73hx Sep 30, 2019

Improper Input Validation in simple_form

9.8 / 10

Critical

Network Low None None Unchanged High High High

Incorrect Access Control in `file_method?` in `lib/simple_form/form_builder.rb`; a user-supplied string is invoked as a method call

Impact

For pages that build a form using user input, it is possible for an attacker to manipulate the input and send any method present in the form object. For example:

<%= simple_form_for @user do |f| %>
  <%= f.label @user_supplied_string %>
  ...
<% end %>

The string provided in the variable @user_supplied_string would be invoked as a method call inside the @user object (unless the string contains any of the following: password, time_zone, country, email, phone and url).

By manipulation that input, an attacker could do any of the following:

Code execution (call actions like #destroy)
Denial of Service (by executing a computation intensive method)
Information Disclosure (check the presence of methods, leak user information)

Patches

The problem was fixed in version 5.0. Although it's a major version, there should be no issues with upgrading for 4.x. The reason it was released in a major version is that the configuration SimpleForm.file_methods was deprecated in order to fix the problem.

Workarounds

The issue only happens with pages that build forms based on user-provided input. If your application doesn't do that, you're not affected. A workaround is to explicitly pass which type you want for an input since the issue lies on Simple Form's automatically discovery of input types. This can be done using the as option, like the following:

<%= form.input :avatar, as: :file %>

References

[TDB]

For more information

If you have any questions or comments about this advisory:

Open an issue in https://github.com/plataformatec/simple_form
Email us at opensource@plataformatec.com.br

Affected versions


          0.4.0

0.5


          1.0.0


          1.0.1


          1.0.2


          1.0.3


          1.0.4


          1.1.0


          1.1.1


          1.1.2


          1.1.3


          1.2.0

+ 41 more


            1.2.1


            1.2.2


            1.3.0


            1.3.1


            1.4.0


            1.4.1


            1.4.2


            1.5.0


            1.5.1


            1.5.2


            2.0.0


            2.0.0.rc


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.1.0


            2.1.1


            2.1.2


            2.1.3


            3.0.0


            3.0.0.beta1


            3.0.0.rc


            3.0.1


            3.0.2


            3.0.3


            3.0.4


            3.1.0


            3.1.0.rc1


            3.1.0.rc2


            3.1.1


            3.2.0


            3.2.1


            3.3.0


            3.3.1


            3.4.0


            3.5.0


            3.5.1


            4.0.0


            4.0.1


            4.1.0

Fixed in


          5.0.0

References

Updated Aug 27, 2026 · Source: OSV.dev

Sep 08, 2011

1.4.2 patch

1 CVE

CVE-2019-16676 GHSA-r74q-gxcg-73hx Sep 30, 2019

Improper Input Validation in simple_form

9.8 / 10

Critical

Network Low None None Unchanged High High High

Incorrect Access Control in `file_method?` in `lib/simple_form/form_builder.rb`; a user-supplied string is invoked as a method call

Impact

For pages that build a form using user input, it is possible for an attacker to manipulate the input and send any method present in the form object. For example:

<%= simple_form_for @user do |f| %>
  <%= f.label @user_supplied_string %>
  ...
<% end %>

The string provided in the variable @user_supplied_string would be invoked as a method call inside the @user object (unless the string contains any of the following: password, time_zone, country, email, phone and url).

By manipulation that input, an attacker could do any of the following:

Code execution (call actions like #destroy)
Denial of Service (by executing a computation intensive method)
Information Disclosure (check the presence of methods, leak user information)

Patches

The problem was fixed in version 5.0. Although it's a major version, there should be no issues with upgrading for 4.x. The reason it was released in a major version is that the configuration SimpleForm.file_methods was deprecated in order to fix the problem.

Workarounds

The issue only happens with pages that build forms based on user-provided input. If your application doesn't do that, you're not affected. A workaround is to explicitly pass which type you want for an input since the issue lies on Simple Form's automatically discovery of input types. This can be done using the as option, like the following:

<%= form.input :avatar, as: :file %>

References

[TDB]

For more information

If you have any questions or comments about this advisory:

Open an issue in https://github.com/plataformatec/simple_form
Email us at opensource@plataformatec.com.br

Affected versions


          0.4.0

0.5


          1.0.0


          1.0.1


          1.0.2


          1.0.3


          1.0.4


          1.1.0


          1.1.1


          1.1.2


          1.1.3


          1.2.0

+ 41 more


            1.2.1


            1.2.2


            1.3.0


            1.3.1


            1.4.0


            1.4.1


            1.4.2


            1.5.0


            1.5.1


            1.5.2


            2.0.0


            2.0.0.rc


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.1.0


            2.1.1


            2.1.2


            2.1.3


            3.0.0


            3.0.0.beta1


            3.0.0.rc


            3.0.1


            3.0.2


            3.0.3


            3.0.4


            3.1.0


            3.1.0.rc1


            3.1.0.rc2


            3.1.1


            3.2.0


            3.2.1


            3.3.0


            3.3.1


            3.4.0


            3.5.0


            3.5.1


            4.0.0


            4.0.1


            4.1.0

Fixed in


          5.0.0

References

Updated Aug 27, 2026 · Source: OSV.dev

Jun 27, 2011

1.4.1 patch

1 CVE

CVE-2019-16676 GHSA-r74q-gxcg-73hx Sep 30, 2019

Improper Input Validation in simple_form

9.8 / 10

Critical

Network Low None None Unchanged High High High

Incorrect Access Control in `file_method?` in `lib/simple_form/form_builder.rb`; a user-supplied string is invoked as a method call

Impact

For pages that build a form using user input, it is possible for an attacker to manipulate the input and send any method present in the form object. For example:

<%= simple_form_for @user do |f| %>
  <%= f.label @user_supplied_string %>
  ...
<% end %>

The string provided in the variable @user_supplied_string would be invoked as a method call inside the @user object (unless the string contains any of the following: password, time_zone, country, email, phone and url).

By manipulation that input, an attacker could do any of the following:

Code execution (call actions like #destroy)
Denial of Service (by executing a computation intensive method)
Information Disclosure (check the presence of methods, leak user information)

Patches

The problem was fixed in version 5.0. Although it's a major version, there should be no issues with upgrading for 4.x. The reason it was released in a major version is that the configuration SimpleForm.file_methods was deprecated in order to fix the problem.

Workarounds

The issue only happens with pages that build forms based on user-provided input. If your application doesn't do that, you're not affected. A workaround is to explicitly pass which type you want for an input since the issue lies on Simple Form's automatically discovery of input types. This can be done using the as option, like the following:

<%= form.input :avatar, as: :file %>

References

[TDB]

For more information

If you have any questions or comments about this advisory:

Open an issue in https://github.com/plataformatec/simple_form
Email us at opensource@plataformatec.com.br

Affected versions


          0.4.0

0.5


          1.0.0


          1.0.1


          1.0.2


          1.0.3


          1.0.4


          1.1.0


          1.1.1


          1.1.2


          1.1.3


          1.2.0

+ 41 more


            1.2.1


            1.2.2


            1.3.0


            1.3.1


            1.4.0


            1.4.1


            1.4.2


            1.5.0


            1.5.1


            1.5.2


            2.0.0


            2.0.0.rc


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.1.0


            2.1.1


            2.1.2


            2.1.3


            3.0.0


            3.0.0.beta1


            3.0.0.rc


            3.0.1


            3.0.2


            3.0.3


            3.0.4


            3.1.0


            3.1.0.rc1


            3.1.0.rc2


            3.1.1


            3.2.0


            3.2.1


            3.3.0


            3.3.1


            3.4.0


            3.5.0


            3.5.1


            4.0.0


            4.0.1


            4.1.0

Fixed in


          5.0.0

References

Updated Aug 27, 2026 · Source: OSV.dev

Jun 14, 2011

1.4.0 minor

1 CVE

CVE-2019-16676 GHSA-r74q-gxcg-73hx Sep 30, 2019

Improper Input Validation in simple_form

9.8 / 10

Critical

Network Low None None Unchanged High High High

Incorrect Access Control in `file_method?` in `lib/simple_form/form_builder.rb`; a user-supplied string is invoked as a method call

Impact

For pages that build a form using user input, it is possible for an attacker to manipulate the input and send any method present in the form object. For example:

<%= simple_form_for @user do |f| %>
  <%= f.label @user_supplied_string %>
  ...
<% end %>

The string provided in the variable @user_supplied_string would be invoked as a method call inside the @user object (unless the string contains any of the following: password, time_zone, country, email, phone and url).

By manipulation that input, an attacker could do any of the following:

Code execution (call actions like #destroy)
Denial of Service (by executing a computation intensive method)
Information Disclosure (check the presence of methods, leak user information)

Patches

The problem was fixed in version 5.0. Although it's a major version, there should be no issues with upgrading for 4.x. The reason it was released in a major version is that the configuration SimpleForm.file_methods was deprecated in order to fix the problem.

Workarounds

The issue only happens with pages that build forms based on user-provided input. If your application doesn't do that, you're not affected. A workaround is to explicitly pass which type you want for an input since the issue lies on Simple Form's automatically discovery of input types. This can be done using the as option, like the following:

<%= form.input :avatar, as: :file %>

References

[TDB]

For more information

If you have any questions or comments about this advisory:

Open an issue in https://github.com/plataformatec/simple_form
Email us at opensource@plataformatec.com.br

Affected versions


          0.4.0

0.5


          1.0.0


          1.0.1


          1.0.2


          1.0.3


          1.0.4


          1.1.0


          1.1.1


          1.1.2


          1.1.3


          1.2.0

+ 41 more


            1.2.1


            1.2.2


            1.3.0


            1.3.1


            1.4.0


            1.4.1


            1.4.2


            1.5.0


            1.5.1


            1.5.2


            2.0.0


            2.0.0.rc


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.1.0


            2.1.1


            2.1.2


            2.1.3


            3.0.0


            3.0.0.beta1


            3.0.0.rc


            3.0.1


            3.0.2


            3.0.3


            3.0.4


            3.1.0


            3.1.0.rc1


            3.1.0.rc2


            3.1.1


            3.2.0


            3.2.1


            3.3.0


            3.3.1


            3.4.0


            3.5.0


            3.5.1


            4.0.0


            4.0.1


            4.1.0

Fixed in


          5.0.0

References

Updated Aug 27, 2026 · Source: OSV.dev

May 18, 2011

1.3.1 patch

1 CVE

CVE-2019-16676 GHSA-r74q-gxcg-73hx Sep 30, 2019

Improper Input Validation in simple_form

9.8 / 10

Critical

Network Low None None Unchanged High High High

Incorrect Access Control in `file_method?` in `lib/simple_form/form_builder.rb`; a user-supplied string is invoked as a method call

Impact

For pages that build a form using user input, it is possible for an attacker to manipulate the input and send any method present in the form object. For example:

<%= simple_form_for @user do |f| %>
  <%= f.label @user_supplied_string %>
  ...
<% end %>

The string provided in the variable @user_supplied_string would be invoked as a method call inside the @user object (unless the string contains any of the following: password, time_zone, country, email, phone and url).

By manipulation that input, an attacker could do any of the following:

Code execution (call actions like #destroy)
Denial of Service (by executing a computation intensive method)
Information Disclosure (check the presence of methods, leak user information)

Patches

The problem was fixed in version 5.0. Although it's a major version, there should be no issues with upgrading for 4.x. The reason it was released in a major version is that the configuration SimpleForm.file_methods was deprecated in order to fix the problem.

Workarounds

The issue only happens with pages that build forms based on user-provided input. If your application doesn't do that, you're not affected. A workaround is to explicitly pass which type you want for an input since the issue lies on Simple Form's automatically discovery of input types. This can be done using the as option, like the following:

<%= form.input :avatar, as: :file %>

References

[TDB]

For more information

If you have any questions or comments about this advisory:

Open an issue in https://github.com/plataformatec/simple_form
Email us at opensource@plataformatec.com.br

Affected versions


          0.4.0

0.5


          1.0.0


          1.0.1


          1.0.2


          1.0.3


          1.0.4


          1.1.0


          1.1.1


          1.1.2


          1.1.3


          1.2.0

+ 41 more


            1.2.1


            1.2.2


            1.3.0


            1.3.1


            1.4.0


            1.4.1


            1.4.2


            1.5.0


            1.5.1


            1.5.2


            2.0.0


            2.0.0.rc


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.1.0


            2.1.1


            2.1.2


            2.1.3


            3.0.0


            3.0.0.beta1


            3.0.0.rc


            3.0.1


            3.0.2


            3.0.3


            3.0.4


            3.1.0


            3.1.0.rc1


            3.1.0.rc2


            3.1.1


            3.2.0


            3.2.1


            3.3.0


            3.3.1


            3.4.0


            3.5.0


            3.5.1


            4.0.0


            4.0.1


            4.1.0

Fixed in


          5.0.0

References

Updated Aug 27, 2026 · Source: OSV.dev

Feb 06, 2011

1.3.0 minor

1 CVE

CVE-2019-16676 GHSA-r74q-gxcg-73hx Sep 30, 2019

Improper Input Validation in simple_form

9.8 / 10

Critical

Network Low None None Unchanged High High High

Incorrect Access Control in `file_method?` in `lib/simple_form/form_builder.rb`; a user-supplied string is invoked as a method call

Impact

For pages that build a form using user input, it is possible for an attacker to manipulate the input and send any method present in the form object. For example:

<%= simple_form_for @user do |f| %>
  <%= f.label @user_supplied_string %>
  ...
<% end %>

The string provided in the variable @user_supplied_string would be invoked as a method call inside the @user object (unless the string contains any of the following: password, time_zone, country, email, phone and url).

By manipulation that input, an attacker could do any of the following:

Code execution (call actions like #destroy)
Denial of Service (by executing a computation intensive method)
Information Disclosure (check the presence of methods, leak user information)

Patches

The problem was fixed in version 5.0. Although it's a major version, there should be no issues with upgrading for 4.x. The reason it was released in a major version is that the configuration SimpleForm.file_methods was deprecated in order to fix the problem.

Workarounds

The issue only happens with pages that build forms based on user-provided input. If your application doesn't do that, you're not affected. A workaround is to explicitly pass which type you want for an input since the issue lies on Simple Form's automatically discovery of input types. This can be done using the as option, like the following:

<%= form.input :avatar, as: :file %>

References

[TDB]

For more information

If you have any questions or comments about this advisory:

Open an issue in https://github.com/plataformatec/simple_form
Email us at opensource@plataformatec.com.br

Affected versions


          0.4.0

0.5


          1.0.0


          1.0.1


          1.0.2


          1.0.3


          1.0.4


          1.1.0


          1.1.1


          1.1.2


          1.1.3


          1.2.0

+ 41 more


            1.2.1


            1.2.2


            1.3.0


            1.3.1


            1.4.0


            1.4.1


            1.4.2


            1.5.0


            1.5.1


            1.5.2


            2.0.0


            2.0.0.rc


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.1.0


            2.1.1


            2.1.2


            2.1.3


            3.0.0


            3.0.0.beta1


            3.0.0.rc


            3.0.1


            3.0.2


            3.0.3


            3.0.4


            3.1.0


            3.1.0.rc1


            3.1.0.rc2


            3.1.1


            3.2.0


            3.2.1


            3.3.0


            3.3.1


            3.4.0


            3.5.0


            3.5.1


            4.0.0


            4.0.1


            4.1.0

Fixed in


          5.0.0

References

Updated Aug 27, 2026 · Source: OSV.dev

Dec 08, 2010

1.0.4 patch

1 CVE

CVE-2019-16676 GHSA-r74q-gxcg-73hx Sep 30, 2019

Improper Input Validation in simple_form

9.8 / 10

Critical

Network Low None None Unchanged High High High

Incorrect Access Control in `file_method?` in `lib/simple_form/form_builder.rb`; a user-supplied string is invoked as a method call

Impact

For pages that build a form using user input, it is possible for an attacker to manipulate the input and send any method present in the form object. For example:

<%= simple_form_for @user do |f| %>
  <%= f.label @user_supplied_string %>
  ...
<% end %>

The string provided in the variable @user_supplied_string would be invoked as a method call inside the @user object (unless the string contains any of the following: password, time_zone, country, email, phone and url).

By manipulation that input, an attacker could do any of the following:

Code execution (call actions like #destroy)
Denial of Service (by executing a computation intensive method)
Information Disclosure (check the presence of methods, leak user information)

Patches

The problem was fixed in version 5.0. Although it's a major version, there should be no issues with upgrading for 4.x. The reason it was released in a major version is that the configuration SimpleForm.file_methods was deprecated in order to fix the problem.

Workarounds

The issue only happens with pages that build forms based on user-provided input. If your application doesn't do that, you're not affected. A workaround is to explicitly pass which type you want for an input since the issue lies on Simple Form's automatically discovery of input types. This can be done using the as option, like the following:

<%= form.input :avatar, as: :file %>

References

[TDB]

For more information

If you have any questions or comments about this advisory:

Open an issue in https://github.com/plataformatec/simple_form
Email us at opensource@plataformatec.com.br

Affected versions


          0.4.0

0.5


          1.0.0


          1.0.1


          1.0.2


          1.0.3


          1.0.4


          1.1.0


          1.1.1


          1.1.2


          1.1.3


          1.2.0

+ 41 more


            1.2.1


            1.2.2


            1.3.0


            1.3.1


            1.4.0


            1.4.1


            1.4.2


            1.5.0


            1.5.1


            1.5.2


            2.0.0


            2.0.0.rc


            2.0.1


            2.0.2


            2.0.3


            2.0.4


            2.1.0


            2.1.1


            2.1.2


            2.1.3


            3.0.0


            3.0.0.beta1


            3.0.0.rc


            3.0.1


            3.0.2


            3.0.3


            3.0.4


            3.1.0


            3.1.0.rc1


            3.1.0.rc2


            3.1.1


            3.2.0


            3.2.1


            3.3.0


            3.3.1


            3.4.0


            3.5.0


            3.5.1


            4.0.0


            4.0.1


            4.1.0

Fixed in


          5.0.0

References

Updated Aug 27, 2026 · Source: OSV.dev

Oct 08, 2010

Activity

Reach

Details