CVE-2014-0080

Severity: medium (CVSS 6.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2014-02-20 · updated 2026-06-17
Weakness: CWE-89

Description

SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql/cast.rb in Active Record in Ruby on Rails 4.0.x before 4.0.3, and 4.1.0.beta1, when PostgreSQL is used, allows remote attackers to execute "add data" SQL commands via vectors involving \ (backslash) characters that are not properly handled in operations on array columns.

Affected products

Ruby on Rails: 4.0.0, 4.0.0-beta, 4.0.0-rc1, 4.0.0-rc2, 4.0.1, 4.0.1-rc1 (+5)

References

http://openwall.com/lists/oss-security/2014/02/18/9
https://groups.google.com/forum/message/raw?msg=rubyonrails-security/Wu96YkTUR6s/pPLBMZrlwvYJ
http://openwall.com/lists/oss-security/2014/02/18/9
https://groups.google.com/forum/message/raw?msg=rubyonrails-security/Wu96YkTUR6s/pPLBMZrlwvYJ

Get alerted when CVE-2014-0080 or the next vulnerability affects your stack