activesupport Known Vulnerabilities & Fixes
activesupport has 6 known security vulnerabilities in RubyGems (Ruby). Upgrade to version 8.1.2.1 or later to resolve all known issues. Data sourced from OSV, enriched with EPSS exploit probability and CISA KEV.
Low Immediate Risk
No actively exploited vulnerabilities detected. Monitor and update in your next maintenance window.
Recommended safe version: 8.1.2.1
Upgrading to 8.1.2.1 or later resolves all 6 known vulnerabilities in activesupport. Run: gem install activesupport -v 8.1.2.1
Is activesupport in your project?
Check if you're affected and upgrade to 8.1.2.1 to stay secure.
Security Summary
- 15 affected version ranges have been identified across these 6 advisories.
- 100% of known issues have a published fixed version.
- Remediation: gem update activesupport
Vulnerabilities
6 unique vulnerabilities — sorted by exploitation risk (KEV → EPSS → CVSS). Click a CVE/GHSA ID for full details. First disclosed May 26, 2020, most recently Mar 23, 2026 (2127 days apart).
| CVE / GHSA | Severity | Affected | Fixed In |
|---|---|---|---|
| CVE-2020-8165 ActiveSupport potentially unintended unmarshalling of user-provided objects in MemCacheStore and RedisCacheStore | CRITICAL | 5.0.0, 5.0.0.1, 5.0.1, 5.0.1.rc1 (+61 more) | 5.2.4.3, 6.0.3.1 |
| CVE-2026-33170 Rails Active Support has a possible XSS vulnerability in SafeBuffer#% | MEDIUM | 8.1.0, 8.1.0.beta1, 8.1.0.rc1, 8.1.1 (+493 more) | 8.1.2.1, 8.0.4.1, 7.2.3.1 |
| CVE-2023-38037 Active Support Possibly Discloses Locally Encrypted Files | MEDIUM | 5.2.0, 5.2.1, 5.2.1.1, 5.2.1.rc1 (+100 more) | 6.1.7.5, 7.0.7.1 |
| CVE-2023-28120 Possible XSS Security Vulnerability in SafeBuffer#bytesplice | MEDIUM | 7.0.0, 7.0.1, 7.0.2, 7.0.2.1 (+418 more) | 7.0.4.3, 6.1.7.3 |
| CVE-2026-33176 Rails Active Support has a possible DoS vulnerability in its number helpers | MEDIUM | 8.1.0, 8.1.0.beta1, 8.1.0.rc1, 8.1.1 (+493 more) | 8.1.2.1, 8.0.4.1, 7.2.3.1 |
| CVE-2026-33169 Rails Active Support has a possible ReDoS vulnerability in number_to_delimited | MEDIUM | 8.1.0, 8.1.0.beta1, 8.1.0.rc1, 8.1.1 (+493 more) | 8.1.2.1, 8.0.4.1, 7.2.3.1 |
About This Data
Vulnerability data for activesupport is sourced from the Open Source Vulnerability (OSV) database, aggregating reports from GitHub Advisory Database, NIST NVD, and ecosystem-specific sources.
CVSS (Common Vulnerability Scoring System) scores reflect exploitability and impact. EPSS (Exploit Prediction Scoring System) scores indicate the probability of exploitation within the next 30 days. Vulnerabilities marked with are listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.
Related RubyGems (Ruby) Packages
Other packages in this ecosystem, ranked by shared vulnerabilities where available.
Check Your Dependencies
Scan your project to check if you're using a vulnerable version of activesupport.