Rails 8.0.5.2 and 8.1.4.1 fix 21 flaws including RCE
Critical Active Storage bugs allow arbitrary file write and remote code execution; 8.0 security support ends in days.
Ruby on Rails has issued security releases 8.0.5.2 and 8.1.4.1 that close 21 vulnerabilities. Mike Dalessio urged users to upgrade immediately.
The most severe flaw, rated critical, lets an attacker achieve arbitrary file write and read through Active Storage image analysis. A related high-severity issue in Active Storage video previews, analysis, and image processing enables arbitrary file read and remote code execution. Applications that process user-supplied images or videos are directly exposed.
Other high-severity problems include a Strong Parameters bypass via Parameters#each_key in Action Pack, possible IP spoofing in Action Dispatch RemoteIp (affecting 8.1 only), and a denial-of-service condition in Active Support safe_constantize. Multiple medium-severity cross-site scripting bugs affect Action View text helpers, the highlight helper, strip_tags, tag helpers, and the Active Support MessagePack serializer.
Older Rails branches receive no security fixes. Maintainers recommend moving at least to the 8.0 series. Security support for 8.0 itself ends on 7 November 2026.