Array data injection vulnerability in activerecord (GHSA-hqf9-rc9j-5fmj)
Published: 2017-10-24T18:33:36Z
Aliases: CVE-2014-0080
Severity: MODERATE · CWE: CWE-89

SQL injection vulnerability in `activerecord/lib/active_record/connection_adapters/postgresql/cast.rb` in Active Record in Ruby on Rails 4.0.x before 4.0.3, and 4.1.0.beta1, when PostgreSQL is used, allows remote attackers to execute "add data" SQL commands via vectors involving `\` (backslash) characters that are not properly handled in operations on array columns.

Affected packages:
package: ecosystem: RubyGems
name: activerecord
ranges: type: ECOSYSTEM
events: introduced: 4.0.0
fixed: 4.0.3
package: ecosystem: RubyGems
name: activerecord
ranges: type: ECOSYSTEM
events: introduced: 4.1.0.beta1
fixed: 4.1.0.beta2
versions: 4.1.0.beta1