Search for vulnerabilities
| Vulnerability ID | VCID-58sa-6uag-z7hp |
| Aliases |
CVE-2013-0156
GHSA-jmgw-6vjg-jjwg OSV-89026 |
| Summary | actionpack Improper Input Validation vulnerability `active_support/core_ext/hash/conversions.rb` in Ruby on Rails before 2.3.15, 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion. |
| Status | Published |
| Exploitability | None |
| Weighted Severity | None |
| Risk | None |
| Affected and Fixed Packages | Package Details |
| Data source | Exploit-DB |
|---|---|
| Date added | Jan. 10, 2013 |
| Description | Ruby on Rails - XML Processor YAML Deserialization Code Execution (Metasploit) |
| Ransomware campaign use | Known |
| Source publication date | Jan. 10, 2013 |
| Exploit type | remote |
| Platform | multiple |
| Source update date | Jan. 10, 2013 |
| Data source | Metasploit |
|---|---|
| Description | This module exploits a remote code execution vulnerability in the XML request processor of the Ruby on Rails application framework. This vulnerability allows an attacker to instantiate a remote object, which in turn can be used to execute any ruby code remotely in the context of the application. This module has been tested across multiple versions of RoR 3.x and RoR 2.x The technique used by this module requires the target to be running a fairly recent version of Ruby 1.9 (since 2011 or so). Applications using Ruby 1.8 may still be exploitable using the init_with() method, but this has not been demonstrated. |
| Note | Reliability: - unknown-reliability Stability: - unknown-stability SideEffects: - unknown-side-effects |
| Ransomware campaign use | Unknown |
| Source publication date | Jan. 7, 2013 |
| Platform | Ruby |
| Source URL | https://github.com/rapid7/metasploit-framework/tree/master/modules/exploits/multi/http/rails_xml_yaml_code_exec.rb |
| Percentile | 0.99708 |
| EPSS Score | 0.91907 |
| Published At | May 29, 2026, 12:55 p.m. |
| Date | Actor | Action | Source | VulnerableCode Version |
|---|---|---|---|---|
| 2026-05-29T08:57:22.161114+00:00 | GithubOSV Importer | Import | https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2017/10/GHSA-jmgw-6vjg-jjwg/GHSA-jmgw-6vjg-jjwg.json | 38.6.0 |