CVE-2023-22794
HIGH
MEDIUM
Priority: 0.19
BB Relevance:
68/100
Published: 2023-02-09
Modified: 2026-10-23
First seen: 2026-10-29
Status: active
Attack Surface
Network
Low Complexity
No Interaction
Conf. Impact
Integ. Impact
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
Low
UI:
None
S:
Unchanged
C:
High
I:
High
A:
High
Description
A vulnerability in ActiveRecord <6.0.6.1, v6.1.7.1 and v7.0.4.1 related to the sanitization of comments. If malicious user input is passed to either the `annotate` query method, the `optimizer_hints` query method, or through the QueryLogs interface which automatically adds annotations, it may be sent to the database withinsufficient sanitization and be able to inject SQL outside of the comment.
Weakness Classification (1)
Affected Software (3)
| Vendor | Product | Version |
|---|---|---|
| activerecord_project | activerecord | 6.0.0 – 6.0.6.1 |
| activerecord_project | activerecord | 6.1.0 – 6.1.7.1 |
| activerecord_project | activerecord | 7.0.0 – 7.0.4.1 |
References & Advisories (3)
Exploit
Patch
Vendor Advisory