{"action":"Upgrade rails to 2.3.14.1 or later.","affected":[{"fixed":"2.3.14.1","introduced":"0"}],"component":"rails","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:14","exploited":false,"fixed_versions":["2.3.14.1"],"id":"tcs_01M5NAB9V62CFFZT1WP22QK4AM","modified_at":"2026-09-01T20:03:15.031311830Z","published_at":"2013-03-19T22:55:01Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2013-1854","https://security-tracker.debian.org/tracker/CVE-2013-1854"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2013-1854#Debian:14/rails","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2013-1854"}],"summary":"The Active Record component in Ruby on Rails 2.3.x before 2.3.18, 3.1.x before 3.1.12, and 3.2.x before 3.2.13 processes certain queries by converting hash keys to symbols, which allows remote attacke"}