# CVE-2022-32224: Ruby on Rails Active Record RCE via YAML Deserialization in Serialized Columns

Source: https://junglewise.ai/threats/cve-2022-32224-ruby-on-rails-active-record-rce-via-yaml-deserialization-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-12-05. Updated: 2026-05-11  
License: CC BY 4.0 with a link back

CVE-2022-32224 · Severity: critical · CVSS 9.8 · Published 2022-12-05

A vulnerability in the Active Record component of Ruby on Rails could allow an attacker to execute malicious code on a server. This occurs when the application processes data stored in the database that has been tampered with, typically through a secondary attack like SQL injection. If exploited, this could lead to a full system takeover, data theft, or complete service disruption.

Technologies: [Ruby on Rails Rails](https://junglewise.ai/threats/technologies/rails), [activerecord (RubyGems)](https://junglewise.ai/threats/technologies/rubygems-activerecord). Vendors: [Ruby on Rails](https://junglewise.ai/threats/vendors/ruby-on-rails), [RubyGems](https://junglewise.ai/threats/vendors/rubygems).

## Quick answers

**Is CVE-2022-32224 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2022-32224 being exploited in the wild.

**How severe is CVE-2022-32224?** Critical severity, with a CVSS score of 9.8, published 5 December 2022.

**Which products and versions are affected?** Ruby on Rails Active Record < 5.2.8.1, >= 6.0.0, < 6.0.5.1, >= 6.1.0, < 6.1.6.1, >= 7.0.0, < 7.0.3.1; Ruby on Rails Rails <= 5.2.8, >= 6.0.0, <= 6.0.5, >= 6.1.0, <= 6.1.6, >= 7.0.0, <= 7.0.3; activerecord (RubyGems) ECOSYSTEM:introduced=7.0.0,fixed=7.0.3.1.

**Is there a fix for CVE-2022-32224?** Yes. activerecord (RubyGems): upgrade to 7.0.3.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2022-32224 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2022-32224?** Check whether you run Ruby on Rails Active Record, Ruby on Rails Rails or activerecord (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- activerecord (RubyGems): upgrade to 7.0.3.1 or later

  ```sh
  bundle update activerecord
  ```


## Technical details

Active Record's YAML serialization coder used 'YAML.unsafe_load' (Psych) by default when retrieving data from serialized columns. This allows for the instantiation of arbitrary Ruby objects, which can be leveraged for remote code execution (CWE-502). An attacker must first be able to manipulate data within the database, for example via a separate SQL injection vulnerability. The fix changes the default deserializer to 'YAML.safe_load' and introduces configuration options ('use_yaml_unsafe_load' and 'yaml_column_permitted_classes') to manage backward compatibility. Patches are available for Rails versions 5.2.x, 6.0.x, 6.1.x, and 7.0.x.

## Affected products

- Ruby on Rails (Rails) activerecord <= 5.2.8, >= 6.0.0, <= 6.0.5, >= 6.1.0, <= 6.1.6, >= 7.0.0, <= 7.0.3

## Identifiers

- CVE-2022-32224
- GHSA-3hhc-qp5v-9p2j

## Timeline

- 2022-07-12: disclosed
- 2022-07-12: patched
- 2022-07-12: advisory

## References

- [https://github.com/rails/rails/commit/611990f1a6c137c2d56b1ba06b27e5d2434dcd6a](https://github.com/rails/rails/commit/611990f1a6c137c2d56b1ba06b27e5d2434dcd6a)
- [https://discuss.rubyonrails.org/t/cve-2022-32224-possible-rce-escalation-bug-with-serialized-columns-in-active-record/81017](https://discuss.rubyonrails.org/t/cve-2022-32224-possible-rce-escalation-bug-with-serialized-columns-in-active-record/81017)
- [https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activerecord/CVE-2022-32224.yml](https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activerecord/CVE-2022-32224.yml)
- [https://groups.google.com/g/rubyonrails-security/c/MmFO3LYQE8U](https://groups.google.com/g/rubyonrails-security/c/MmFO3LYQE8U)
- [https://lists.debian.org/debian-lts-announce/2026/05/msg00022.html](https://lists.debian.org/debian-lts-announce/2026/05/msg00022.html)

## Related threats

- [Ruby on Rails Action View XSS in tag helpers via whitespace attribute names](https://junglewise.ai/threats/cve-2026-126069-action-view-is-a-framework-for-handling-view-template-lookup-and)
- [Active Record logging vulnerable to ANSI escape injection](https://junglewise.ai/threats/cve-2025-55193-active-record-logging-vulnerable-to-ansi-escape-injection)
- [Denial of Service Vulnerability in ActiveRecord's PostgreSQL adapter](https://junglewise.ai/threats/cve-2022-44566-denial-of-service-vulnerability-in-activerecord-s-postgresql)
- [SQL Injection Vulnerability via ActiveRecord comments](https://junglewise.ai/threats/cve-2023-22794-sql-injection-vulnerability-via-activerecord-comments)
- [Active Record component in Ruby on Rails has a data-type injection vulnerability](https://junglewise.ai/threats/cve-2013-3221-active-record-component-in-ruby-on-rails-has-a-data-type-injection)