Rails security releases: 8.0.5.2 and 8.1.4.1
Comments
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Summary
The Rails core team released security updates 8.0.5.2 and 8.1.4.1, fixing 21 vulnerabilities, including a critical Active Storage image analysis flaw enabling arbitrary file write and read. Several others are high severity, covering Strong Parameters bypass, IP spoofing in RemoteIp, and remote code execution in Active Storage previews.