{"action":"Upgrade activerecord to 6.0.6.1 or later.","affected":[{"fixed":"6.0.6.1","introduced":"6.0.0"},{"fixed":"6.1.7.1","introduced":"6.1.0"},{"fixed":"7.0.4.1","introduced":"7.0.0"}],"component":"activerecord","cve_ids":["CVE-2023-22794"],"ecosystem":"RubyGems","epss":0.02153,"exploited":false,"fixed_versions":["6.0.6.1","6.1.7.1","7.0.4.1"],"ghsa_id":"GHSA-hq7p-j377-6v63","id":"tcs_01M5KEKNRKNVSJBHT06566CX9W","modified_at":"2024-02-21T05:41:43.535952Z","published_at":"2023-01-18T18:20:19Z","references":["https://osv.dev/vulnerability/GHSA-hq7p-j377-6v63","https://nvd.nist.gov/vuln/detail/CVE-2023-22794","https://github.com/rails/rails/commit/d7aba06953f9fa789c411676b941d20df8ef73de","https://discuss.rubyonrails.org/t/cve-2023-22794-sql-injection-vulnerability-via-activerecord-comments/82117","https://github.com/rails/rails","https://github.com/rails/rails/releases/tag/v7.0.4.1","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activerecord/CVE-2023-22794.yml","https://security.netapp.com/advisory/ntap-20240202-0008","https://www.debian.org/security/2023/dsa-5372"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"GHSA-hq7p-j377-6v63","url":"https://osv.dev/vulnerability/GHSA-hq7p-j377-6v63"}],"summary":"SQL Injection Vulnerability via ActiveRecord comments"}