Executive brief
A vulnerability in the Active Record component of Ruby on Rails could allow an attacker to execute malicious code on a server. This occurs when the application processes data stored in the database that has been tampered with, typically through a secondary attack like SQL injection. If exploited, this could lead to a full system takeover, data theft, or complete service disruption.
Technical details
Active Record's YAML serialization coder used 'YAML.unsafe_load' (Psych) by default when retrieving data from serialized columns. This allows for the instantiation of arbitrary Ruby objects, which can be leveraged for remote code execution (CWE-502). An attacker must first be able to manipulate data within the database, for example via a separate SQL injection vulnerability. The fix changes the default deserializer to 'YAML.safe_load' and introduces configuration options ('use_yaml_unsafe_load' and 'yaml_column_permitted_classes') to manage backward compatibility. Patches are available for Rails versions 5.2.x, 6.0.x, 6.1.x, and 7.0.x.
Affected products
- Ruby on Rails (Rails) activerecord <= 5.2.8, >= 6.0.0, <= 6.0.5, >= 6.1.0, <= 6.1.6, >= 7.0.0, <= 7.0.3
Timeline
- 2022-07-12: disclosed
- 2022-07-12: patched
- 2022-07-12: advisory
References
- https://github.com/rails/rails/commit/611990f1a6c137c2d56b1ba06b27e5d2434dcd6a
- https://discuss.rubyonrails.org/t/cve-2022-32224-possible-rce-escalation-bug-with-serialized-columns-in-active-record/81017
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activerecord/CVE-2022-32224.yml
- https://groups.google.com/g/rubyonrails-security/c/MmFO3LYQE8U
- https://lists.debian.org/debian-lts-announce/2026/05/msg00022.html