GHSA-3hhc-qp5v-9p2j

    Dashboard / Vulnerabilities / GHSA-3hhc-qp5v-9p2j

    GHSA-3hhc-qp5v-9p2j

    Published: 12 Jul 2022Last Modified: 8 Jul 2026

    Summary: Active Record RCE bug with Serialized Columns

    Details: When serialized columns that use YAML (the default) are deserialized, Rails uses YAML.unsafe_load to convert the YAML data in to Ruby objects. If an attacker can manipulate data in the database (via means like SQL injection), then it may be possible for the attacker to escalate to an RCE. There are no feasible workarounds for this issue, but other coders (such as JSON) are not impacted.

    References: https://nvd.nist.gov/vuln/detail/CVE-2022-32224, https://github.com/rails/rails/commit/611990f1a6c137c2d56b1ba06b27e5d2434dcd6a, https://discuss.rubyonrails.org/t/cve-2022-32224-possible-rce-escalation-bug-with-serialized-columns-in-active-record/81017, https://github.com/advisories/GHSA-3hhc-qp5v-9p2j, https://github.com/rails/rails/commits/main/activerecord, https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activerecord/CVE-2022-32224.yml, https://groups.google.com/g/rubyonrails-security/c/MmFO3LYQE8U, https://lists.debian.org/debian-lts-announce/2026/05/msg00022.html

    Affected packages

    Package

    Name: activerecord

    Purl: pkg:gem/activerecord

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 7.0.0
    Fixed -7.0.3.1

    Affected versions

    7.0.0
    7.0.1
    7.0.2
    7.0.2.1
    7.0.2.2
    7.0.2.3
    7.0.2.4
    7.0.3

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-3hhc-qp5v-9p2j | CVE-DB