Vulnerability · Published Feb 9, 2023 · Assigned by hackerone
CVE-2023-22794
High 8.8
In plain English
A high-severity SQL injection in https://github.com/rails/rails. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.2% (higher than 82% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A vulnerability in ActiveRecord <6.0.6.1, v6.1.7.1 and v7.0.4.1 related to the sanitization of comments. If malicious user input is passed to either the `annotate` query method, the `optimizer_hints` query method, or through the QueryLogs interface which automatically adds annotations, it may be sent to the database withinsufficient sanitization and be able to inject SQL outside of the comment.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | rails | 2:6.1.7.3+dfsg-1 | DEBIAN-CVE-2023-22794 |
| Debian:13 | rails | 2:6.1.7.3+dfsg-1 | DEBIAN-CVE-2023-22794 |
| Debian:14 | rails | 2:6.1.7.3+dfsg-1 | DEBIAN-CVE-2023-22794 |
| RubyGems | activerecord | 6.0.6.1 | GHSA-hq7p-j377-6v63 |
| RubyGems | activerecord | 6.1.7.1 | GHSA-hq7p-j377-6v63 |
| RubyGems | activerecord | 7.0.4.1 | GHSA-hq7p-j377-6v63 |
| Ubuntu:24.04:LTS | rails | no fix listed | UBUNTU-CVE-2023-22794 |
| Ubuntu:25.10 | rails | no fix listed | UBUNTU-CVE-2023-22794 |
| Ubuntu:26.04:LTS | rails | no fix listed | UBUNTU-CVE-2023-22794 |
| Ubuntu:26.10 | rails | no fix listed | UBUNTU-CVE-2023-22794 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | https://github.com/rails/rails | 6.0.6.1, 6.1.7.1, 7.0.4.1 |
Weakness: CWE-89