Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:gem/activerecord@4.2.5.0
purl pkg:gem/activerecord@4.2.5.0
Tags Ghost
Next non-vulnerable version 7.1.5.2
Latest non-vulnerable version 8.0.2.1
Risk 3.1
Vulnerabilities affecting this package (1)
Vulnerability Summary Fixed by
VCID-f4h5-8f57-3uhr
Aliases:
GHSA-7phj-gmgx-2r66
Moderate severity vulnerability that affects activerecord Withdrawn, accidental duplicate publish. activerecord/lib/active_record/nested_attributes.rb in Active Record in Ruby on Rails 3.1.x and 3.2.x before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 does not properly implement a certain destroy option, which allows remote attackers to bypass intended change restrictions by leveraging use of the nested attributes feature.
4.2.5.1
Affected by 11 other vulnerabilities.
Vulnerabilities fixed by this package (0)
Vulnerability Summary Aliases
This package is not known to fix vulnerabilities.

Date Actor Action Vulnerability Source VulnerableCode Version
2026-04-01T15:56:41.099375+00:00 GHSA Importer Affected by VCID-f4h5-8f57-3uhr https://github.com/advisories/GHSA-7phj-gmgx-2r66 38.0.0