{"action":"Upgrade activestorage to 5.2.6.3 or later.","affected":[{"fixed":"5.2.6.3","introduced":"5.2.0"},{"fixed":"6.0.4.7","introduced":"6.0.0"},{"fixed":"6.1.4.7","introduced":"6.1.0"},{"fixed":"7.0.2.3","introduced":"7.0.0"}],"component":"activestorage","cve_ids":["CVE-2022-21831"],"ecosystem":"RubyGems","epss":0.03098,"exploited":false,"fixed_versions":["5.2.6.3","6.0.4.7","6.1.4.7","7.0.2.3"],"ghsa_id":"GHSA-w749-p3v6-hccq","id":"tcs_01M5KENTT90JN2M14E61H9CXJR","modified_at":"2026-03-13T22:14:30.413627Z","published_at":"2022-03-08T21:25:54Z","references":["https://osv.dev/vulnerability/GHSA-w749-p3v6-hccq","https://nvd.nist.gov/vuln/detail/CVE-2022-21831","https://github.com/rails/rails/commit/0a72f7d670e9aa77a0bb8584cb1411ddabb7546e","https://github.com/advisories/GHSA-w749-p3v6-hccq","https://github.com/rails/rails","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activestorage/CVE-2022-21831.yml","https://groups.google.com/g/rubyonrails-security/c/n-p-W1yxatI","https://lists.debian.org/debian-lts-announce/2022/09/msg00002.html","https://rubysec.com/advisories/CVE-2022-21831","https://security.netapp.com/advisory/ntap-20221118-0001","https://www.debian.org/security/2023/dsa-5372"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-w749-p3v6-hccq","url":"https://osv.dev/vulnerability/GHSA-w749-p3v6-hccq"}],"summary":"Possible code injection vulnerability in Rails / Active Storage"}