{"action":"Upgrade activerecord to 4.2.0 or later.","affected":[{"fixed":"4.2.0","introduced":"0"}],"component":"activerecord","cve_ids":["CVE-2013-3221"],"ecosystem":"RubyGems","epss":0.024,"exploited":false,"fixed_versions":["4.2.0"],"ghsa_id":"GHSA-f57c-hx33-hvh8","id":"tcs_01M5KEJY6HZZ7JSFRZXCP508ZZ","modified_at":"2026-02-03T17:50:09.070094Z","published_at":"2022-05-14T00:54:20Z","references":["https://osv.dev/vulnerability/GHSA-f57c-hx33-hvh8","https://nvd.nist.gov/vuln/detail/CVE-2013-3221","https://github.com/rails/rails","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activerecord/CVE-2013-3221.yml","https://groups.google.com/group/rubyonrails-security/msg/1f3bc0b88a60c1ce?dmode=source&output=gplain","https://web.archive.org/web/20130825191249/http://www.phenoelit.org/blog/archives/2013/02/index.html","http://openwall.com/lists/oss-security/2013/02/06/7","http://openwall.com/lists/oss-security/2013/04/24/7","http://pl.reddit.com/r/netsec/comments/17yajp/mysql_madness_and_rails"],"severity":{"label":"critical"},"sources":[{"source":"osv","source_id":"GHSA-f57c-hx33-hvh8","url":"https://osv.dev/vulnerability/GHSA-f57c-hx33-hvh8"}],"summary":"Active Record component in Ruby on Rails has a data-type injection vulnerability"}