Rails 8.0.5.2 / 8.1.4.1 security releases fix 21 flaws incl. Active Storage RCE
Severity: critical · Patch status: patched · Since 2026-11-04
On 2026-11-03 the Rails project released 8.0.5.2 and 8.1.4.1, security updates addressing 21 vulnerabilities across the framework. The most severe is a Critical arbitrary file write and read in Active Storage image analysis (GHSA-f3w6-w445-fwh9), plus a High arbitrary file read and remote code execution in Active Storage video previews, analysis and image processing (GHSA-v924-7rp8-4mxh), a High Strong Parameters bypass in Parameterseachkey, an 8.1-only IP spoofing flaw in Action Dispatch RemoteIp, and a High DoS in Active Support safeconstantize. Remaining issues include multiple XSS flaws in Action View helpers, DoS issues, Active Storage direct-upload weaknesses on GCS, session restoration and SameSite cookie problems, cache poisoning, and a Mailgun signature replay. No in-the-wild exploitation is reported. All users on unsupported older versions should upgrade to at least the 8.0 series; 8.0 security support ends 2026-11-07.
What to do
- Upgrade all Rails apps to 8.1.4.1 or 8.0.5.2 immediately, prioritising apps using Active Storage image/video analysis
- Audit apps on Rails <8.0 and plan migration to the 8.0 series before support ends 2026-11-07
- Review Active Storage configurations (proxy mode, GCS direct uploads, cache_control) against the listed advisories
- Check session store settings for SameSite cookie attribute and CacheStore session restoration exposure
- Verify gem SHA-256 hashes against the published list when updating
Fixed versions
Sources
All live incidents on Threat Watch
