What’s Vulnerable › Vulnerabilities

CVE-2022-32224: Active Record RCE bug with Serialized Columns

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-12-05 · updated 2026-06-17
• Weakness: CWE-502

Description

A possible escalation to RCE vulnerability exists when using YAML serialized columns in Active Record < 7.0.3.1, <6.1.6.1, <6.0.5.1 and <5.2.8.1 which could allow an attacker, that can manipulate data in the database (via means like SQL injection), the ability to escalate to an RCE.

Affected products

• Activerecord Project Activerecord: before 5.2.8.1; from 6.0.0 before 6.0.5.1; from 6.1.0 before 6.1.6.1; from 7.0.0 before 7.0.3.1 — fixed in 5.2.8.1, 6.0.5.1, 6.1.6.1, 7.0.3.1
• Rubygems Activerecord: from 7.0.0 before 7.0.3.1; from 6.1.0 before 6.1.6.1; from 6.0.0 before 6.0.5.1; before 5.2.8.1; 7.0.0, 7.0.1, 7.0.2, 7.0.2.1, 7.0.2.2, 7.0.2.3 (+409) — fixed in 7.0.3.1, 6.1.6.1, 6.0.5.1, 5.2.8.1

How to fix

Upgrade to a fixed version: Activerecord Project Activerecord 5.2.8.1, 6.0.5.1, 6.1.6.1, 7.0.3.1; Rubygems Activerecord 7.0.3.1, 6.1.6.1, 6.0.5.1, 5.2.8.1. Check the vendor advisory for mitigations.

References

• https://github.com/advisories/GHSA-3hhc-qp5v-9p2j
• https://groups.google.com/g/rubyonrails-security/c/MmFO3LYQE8U
• https://github.com/advisories/GHSA-3hhc-qp5v-9p2j
• https://groups.google.com/g/rubyonrails-security/c/MmFO3LYQE8U
• https://lists.debian.org/debian-lts-announce/2026/05/msg00022.html

Get alerted when CVE-2022-32224 or the next vulnerability affects your stack