CVE-2020-7981

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-01-25 · updated 2026-06-17
Weakness: CWE-89

Description

sql.rb in Geocoder before 1.6.1 allows Boolean-based SQL injection when within_bounding_box is used in conjunction with untrusted sw_lat, sw_lng, ne_lat, or ne_lng data.

Affected products

Rubygeocoder Geocoder: before 1.6.1 — fixed in 1.6.1

How to fix

Upgrade to a fixed version: Rubygeocoder Geocoder 1.6.1. Check the vendor advisory for mitigations.

References

https://github.com/alexreisner/geocoder/commit/dcdc3d8675411edce3965941a2ca7c441ca48613
https://github.com/alexreisner/geocoder/compare/v1.6.0...v1.6.1
https://github.com/alexreisner/geocoder/commit/dcdc3d8675411edce3965941a2ca7c441ca48613
https://github.com/alexreisner/geocoder/compare/v1.6.0...v1.6.1

Get alerted when CVE-2020-7981 or the next vulnerability affects your stack