A vulnerability allowing SQL code injection has been fixed in Ruby on Rails
Corrective updates for Ruby on Rails framework versions 7.0.4.1, 6.1.7.1, and 6.0.6.1 have been released, fixing 6 vulnerabilities. The most critical vulnerability (CVE-2023-22794) may allow execution of SQL commands specified by an attacker when using external data in comments processed in ActiveRecord. This issue is caused by the lack of necessary escaping of special characters in comments before they are stored in the DBMS. The second vulnerability (CVE-2023-22797) may be applied to […]
