Ruby on Rails vulnerabilities
Vulnerability disclosures, patches, and security advisories for Ruby on Rails and its ecosystem — including Active Storage, Action Pack, and other framework components. Rails powers a broad share of production web applications, so critical flaws in shared components can expose application secrets and server files across thousands of deployments simultaneously.
We track 1 Ruby on Rails CVE; none is on CISA's KEV catalog yet.
- CVEs tracked
- 1
- On CISA KEV
- 0
- Ransomware use
- 0
- Rated critical
- 1
Latest Ruby on Rails coverage
Our reporting filed under Ruby on Rails, plus any story that cites one of its CVEs.
Rails Active Storage ImageMagick Flaw Allows File Writes
Rails fixed a critical Active Storage flaw in 8.1.4.1 and 8.0.5.2. Apps using ImageMagick on untrusted uploads let attackers write server files.
Rails Patches Critical File Read via Image Upload
Ruby on Rails patches a critical Active Storage flaw letting unauthenticated attackers read server files—exposing app secrets and database credentials through crafted image uploads.
Other Ruby on Rails CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-66066 Ruby on Rails Active Storage arbitrary file read via libvipswrite-up | [ CRITICAL ] | 9.5 | 32.9% | — |
Not on CISA KEV as of our last sync. Severity and CVSS as stated by NVD or the vendor; EPSS from FIRST.org.
Machine-readable: /api/v1/vendors/ruby-on-rails.json.
Every CVE row links to its record with the CISA required action, catalog coverage and primary sources. We describe impact and remediation only; no exploit code. See the full KEV tracker, the vendor scorecard, or all vendors.