{"action":"Upgrade carrierwave to 1.3.2 or later.","affected":[{"fixed":"1.3.2","introduced":"0"},{"fixed":"2.1.1","introduced":"2.0.0"}],"component":"carrierwave","cve_ids":["CVE-2021-21288"],"ecosystem":"RubyGems","epss":0.01173,"exploited":false,"fixed_versions":["1.3.2","2.1.1"],"ghsa_id":"GHSA-fwcm-636p-68r5","id":"tcs_01M5KEK5S5A3Z29SW6DPEJ1Y7C","modified_at":"2026-09-10T03:49:14.221682448Z","published_at":"2021-02-08T19:16:26Z","references":["https://osv.dev/vulnerability/GHSA-fwcm-636p-68r5","https://github.com/carrierwaveuploader/carrierwave/security/advisories/GHSA-fwcm-636p-68r5","https://nvd.nist.gov/vuln/detail/CVE-2021-21288","https://github.com/carrierwaveuploader/carrierwave/commit/012702eb3ba1663452aa025831caa304d1a665c0","https://github.com/carrierwaveuploader/carrierwave","https://github.com/carrierwaveuploader/carrierwave/blob/master/CHANGELOG.md#132---2021-02-08","https://github.com/carrierwaveuploader/carrierwave/blob/master/CHANGELOG.md#211---2021-02-08","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/carrierwave/CVE-2021-21288.yml","https://rubygems.org/gems/carrierwave"],"severity":{"label":"medium","score":4.3},"sources":[{"source":"osv","source_id":"GHSA-fwcm-636p-68r5","url":"https://osv.dev/vulnerability/GHSA-fwcm-636p-68r5"}],"summary":"Server-side request forgery in CarrierWave"}