What’s Vulnerable › Vulnerabilities

CVE-2019-16676: Improper Input Validation in simple_form

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 3.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2019-09-30 · updated 2026-06-17
• Weakness: CWE-20

Description

Plataformatec Simple Form has Incorrect Access Control in file_method? in lib/simple_form/form_builder.rb, because a user-supplied string is invoked as a method call.

Affected products

• Plataformatec Simple Form: before 5.0 — fixed in 5.0
• Rubygems Simple Form: before 5.0.0; 0.4.0, 0.5, 1.0.0, 1.0.1, 1.0.2, 1.0.3 (+47) — fixed in 5.0.0

How to fix

Upgrade to a fixed version: Plataformatec Simple Form 5.0; Rubygems Simple Form 5.0.0. Check the vendor advisory for mitigations.

References

• http://blog.plataformatec.com.br/2019/09/incorrect-access-control-in-simple-form-cve-2019-16676/
• https://github.com/plataformatec/simple_form/commits/master
• https://github.com/plataformatec/simple_form/security/advisories/GHSA-r74q-gxcg-73hx
• http://blog.plataformatec.com.br/2019/09/incorrect-access-control-in-simple-form-cve-2019-16676/
• https://github.com/plataformatec/simple_form/commits/master
• https://github.com/plataformatec/simple_form/security/advisories/GHSA-r74q-gxcg-73hx

Get alerted when CVE-2019-16676 or the next vulnerability affects your stack