A vulnerability in ActiveRecord <6.0.6.1, v6.1.7.1 and v7.0.4.1 related to the sanitization of comments. If malicious user input is passed to either the `annotate` query method, the `optimizer_hints` query method, or through the QueryLogs interface which automatically adds annotations, it may be sent to the database withinsufficient sanitization and be able to inject SQL outside of the comment.
Fix
Patch, vendor advisory and mitigation references on NVD 2
- https://discuss.rubyonrails.org/t/cve-2023-22794-sql-injection-vulnerability-via-activerecord-comments/82117 Exploit, Patch, Vendor Advisory
- https://discuss.rubyonrails.org/t/cve-2023-22794-sql-injection-vulnerability-via-activerecord-comments/82117 Exploit, Patch, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 8.8 · activerecord_projectNVD modified 2026-10-23 23:10
Affected (CPE criteria) 1
cpe:2.3:a:activerecord_project:activerecord:*:*:*:*:*:ruby:*:*
References 6
- https://discuss.rubyonrails.org/t/cve-2023-22794-sql-injection-vulnerability-via-activerecord-comments/82117 Exploit, Patch, Vendor Advisory
- https://security.netapp.com/advisory/ntap-20240202-0008/
- https://www.debian.org/security/2023/dsa-5372
- https://discuss.rubyonrails.org/t/cve-2023-22794-sql-injection-vulnerability-via-activerecord-comments/82117 Exploit, Patch, Vendor Advisory
- https://security.netapp.com/advisory/ntap-20240202-0008/
- https://www.debian.org/security/2023/dsa-5372