Loading...
Skip to main content
GeekWala

CVE-2022-21831 — Possible code injection vulnerability in...

CRITICAL

Possible code injection vulnerability in Rails / Active Storage

Published March 8, 2022Updated March 13, 2026Source: osv

Summary

The Active Storage module of Rails starting with version 5.2.0 is possibly vulnerable to code injection. This issue was patched in versions 5.2.6.3, 6.0.4.7, 6.1.4.7, and 7.0.2.3. To work around this issue, applications should implement a strict allow-list on accepted transformation methods or arguments. Additionally, a strict ImageMagick security policy will help mitigate this issue.

Advisory Timeline

  • First published March 8, 2022 (1679 days ago).
  • Last revised March 13, 2026 — 1466 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Bundler
Update activestorage to 5.2.6.3 or later
gem install activestorage -v 5.2.6.3
Bundler
Update activestorage to 6.0.4.7 or later
gem install activestorage -v 6.0.4.7
Bundler
Update activestorage to 7.0.2.3 or later
gem install activestorage -v 7.0.2.3
Bundler
Update activestorage to 6.1.4.7 or later
gem install activestorage -v 6.1.4.7

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (4)

Affects 1 ecosystem: rubygems (1).

PackageEcosystemAffectedFixed In
activestorage
rubygems
5.2.0, 5.2.1, 5.2.1.1, 5.2.1.rc1 (+17 more)5.2.6.3
activestorage
rubygems
6.0.0, 6.0.1, 6.0.1.rc1, 6.0.2 (+20 more)6.0.4.7
activestorage
rubygems
7.0.0, 7.0.1, 7.0.2, 7.0.2.1 (+1 more)7.0.2.3
activestorage
rubygems
6.1.0, 6.1.1, 6.1.2, 6.1.2.1 (+10 more)6.1.4.7

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 9.8 score means for each attack dimension.

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Frequently Asked Questions

What is CVE-2022-21831?
Possible code injection vulnerability in Rails / Active Storage This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.8/10).
How do I check if my project is affected by CVE-2022-21831?
CVE-2022-21831 affects activestorage. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2022-21831 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
9.8

Exploitation is straightforward and causes maximum impact. Patch immediately.

Also Known As

GHSA-w749-p3v6-hccq

Related CVEs

  • CVE-2025-24293
    CRITICAL

    Active Storage allowed transformation methods that were potentially unsafe

  • CVE-2026-66066
    CRITICAL

    Active Storage has possible arbitrary file read and remote code execution in Active Storage variant processing

  • CVE-2026-33202
    MEDIUM

    Rails Active Storage has possible glob injection in its DiskService

  • CVE-2018-16477
    MEDIUM

    Exposure of Sensitive Information to an Unauthorized Actor in activestorage

  • CVE-2024-26144
    MEDIUM

    Rails has possible Sensitive Session Information Leak in Active Storage

  • CVE-2026-33173
    MEDIUM

    Rails Active Storage has possible content type bypass via metadata in direct uploads

  • CVE-2026-33174
    MEDIUM

    Rails Active Storage has a possible DoS vulnerability when in proxy mode via Range requests

  • CVE-2026-33658
    LOW

    Rails Active Storage has a possible DoS vulnerability in proxy mode via multi-range requests

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies