Security

.github/security.md

Security Policy

Reporting a Vulnerability

Do not open up a GitHub issue if the bug is a security vulnerability in Rails. Instead, refer to our security policy.

Supported Versions

Security backports are provided for some previous release series. For details of which release series are currently receiving security backports see our security policy.

Possible glob injection in Active Storage DiskService
GHSA-73f9-jhhh-hr5m published Mar 23, 2026 by jhawthorn

Low
Possible path traversal in Active Storage DiskService
GHSA-9xrj-h377-fr87 published Mar 23, 2026 by jhawthorn

Low
Possible DoS vulnerability in Active Storage proxy mode via multi-range requests
GHSA-p9fm-f462-ggrg published Mar 23, 2026 by jhawthorn

Low
Possible DoS vulnerability in Active Support number helpers
GHSA-2j26-frm8-cmj9 published Mar 23, 2026 by jhawthorn

Low
Possible DoS vulnerability in Active Storage proxy mode via Range requests
GHSA-r46p-8f7g-vvvg published Mar 23, 2026 by jhawthorn

Low
Insufficient filtering of metadata in Active Storage direct uploads
GHSA-qcfx-2mfw-w4cg published Mar 23, 2026 by jhawthorn

Low
Possible XSS vulnerability in SafeBuffer#% in Active Support
GHSA-89vf-4333-qx8v published Mar 23, 2026 by jhawthorn

Low
Possible ReDoS vulnerability in number_to_delimited in Active Support
GHSA-cg4j-q9v8-6v38 published Mar 23, 2026 by jhawthorn

Low
Possible XSS vulnerability in Action View tag helpers
GHSA-v55j-83pf-r9cq published Mar 23, 2026 by jhawthorn

Low
Possible XSS vulnerability in Action Pack debug exceptions
GHSA-pgm4-439c-5jp6 published Mar 23, 2026 by jhawthorn

Low

Previous 1 2 3 Next

Learn more about advisories related to rails/rails in the GitHub Advisory Database