{"action":"Upgrade activerecord to 5.2.8.1 or later.","affected":[{"fixed":"7.0.3.1","introduced":"7.0.0"},{"fixed":"6.1.6.1","introduced":"6.1.0"},{"fixed":"6.0.5.1","introduced":"6.0.0"},{"fixed":"5.2.8.1","introduced":"0"}],"component":"activerecord","cve_ids":["CVE-2022-32224"],"ecosystem":"RubyGems","epss":0.02601,"exploited":false,"fixed_versions":["7.0.3.1","6.1.6.1","6.0.5.1","5.2.8.1"],"ghsa_id":"GHSA-3hhc-qp5v-9p2j","id":"tcs_01M5KEGABG8104J2ES0YW4VQCV","modified_at":"2026-07-08T06:29:07.745701671Z","published_at":"2022-07-12T19:39:47Z","references":["https://osv.dev/vulnerability/GHSA-3hhc-qp5v-9p2j","https://nvd.nist.gov/vuln/detail/CVE-2022-32224","https://github.com/rails/rails/commit/611990f1a6c137c2d56b1ba06b27e5d2434dcd6a","https://discuss.rubyonrails.org/t/cve-2022-32224-possible-rce-escalation-bug-with-serialized-columns-in-active-record/81017","https://github.com/advisories/GHSA-3hhc-qp5v-9p2j","https://github.com/rails/rails/commits/main/activerecord","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activerecord/CVE-2022-32224.yml","https://groups.google.com/g/rubyonrails-security/c/MmFO3LYQE8U","https://lists.debian.org/debian-lts-announce/2026/05/msg00022.html"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-3hhc-qp5v-9p2j","url":"https://osv.dev/vulnerability/GHSA-3hhc-qp5v-9p2j"}],"summary":"Active Record RCE bug with Serialized Columns"}