Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-tjcm-cvtx-jbgt
Vulnerability ID VCID-tjcm-cvtx-jbgt
Aliases CVE-2020-8165
GHSA-2p68-f74v-9wc6
Summary ActiveSupport potentially unintended unmarshalling of user-provided objects in MemCacheStore and RedisCacheStore In ActiveSupport, there is potentially unexpected behaviour in the MemCacheStore and RedisCacheStore where, when untrusted user input is written to the cache store using the `raw: true` parameter, re-reading the result from the cache can evaluate the user input as a Marshalled object instead of plain text. Vulnerable code looks like: ``` data = cache.fetch("demo", raw: true) { untrusted_string } ``` Versions Affected: rails < 5.2.5, rails < 6.0.4 Not affected: Applications not using MemCacheStore or RedisCacheStore. Applications that do not use the `raw` option when storing untrusted user input. Fixed Versions: rails >= 5.2.4.3, rails >= 6.0.3.1 Impact ------ Unmarshalling of untrusted user input can have impact up to and including RCE. At a minimum, this vulnerability allows an attacker to inject untrusted Ruby objects into a web application. In addition to upgrading to the latest versions of Rails, developers should ensure that whenever they are calling `Rails.cache.fetch` they are using consistent values of the `raw` parameter for both reading and writing, especially in the case of the RedisCacheStore which does not, prior to these changes, detect if data was serialized using the raw option upon deserialization. Workarounds ----------- It is recommended that application developers apply the suggested patch or upgrade to the latest release as soon as possible. If this is not possible, we recommend ensuring that all user-provided strings cached using the `raw` argument should be double-checked to ensure that they conform to the expected format.
Status Published
Exploitability None
Weighted Severity None
Risk None
Affected and Fixed Packages Package Details
Weaknesses (2)
CWE-502 Deserialization of Untrusted Data
CWE-20 Improper Input Validation
System Score Found at
cvssv3.1 9.8 http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00031.html
generic_textual CRITICAL http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00031.html
cvssv3.1 9.8 http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00034.html
generic_textual CRITICAL http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00034.html
cvssv3 9.8 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-8165.json
epss 0.90128 https://api.first.org/data/v1/epss?cve=CVE-2020-8165
cvssv3.1 9.8 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1_qr CRITICAL https://github.com/advisories/GHSA-2p68-f74v-9wc6
cvssv3.1 9.8 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activesupport/CVE-2020-8165.yml
generic_textual CRITICAL https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activesupport/CVE-2020-8165.yml
cvssv3 9.8 https://groups.google.com/forum/#!topic/rubyonrails-security/bv6fW4S0Y1c
cvssv3.1 9.8 https://groups.google.com/forum/#!topic/rubyonrails-security/bv6fW4S0Y1c
generic_textual CRITICAL https://groups.google.com/forum/#!topic/rubyonrails-security/bv6fW4S0Y1c
cvssv3.1 9.8 https://groups.google.com/g/rubyonrails-security/c/bv6fW4S0Y1c
generic_textual CRITICAL https://groups.google.com/g/rubyonrails-security/c/bv6fW4S0Y1c
cvssv3.1 9.8 https://hackerone.com/reports/413388
generic_textual CRITICAL https://hackerone.com/reports/413388
cvssv3.1 9.8 https://lists.debian.org/debian-lts-announce/2020/06/msg00022.html
generic_textual CRITICAL https://lists.debian.org/debian-lts-announce/2020/06/msg00022.html
cvssv3.1 9.8 https://lists.debian.org/debian-lts-announce/2020/07/msg00013.html
generic_textual CRITICAL https://lists.debian.org/debian-lts-announce/2020/07/msg00013.html
cvssv3.1 9.8 https://nvd.nist.gov/vuln/detail/CVE-2020-8165
generic_textual CRITICAL https://nvd.nist.gov/vuln/detail/CVE-2020-8165
cvssv3.1 9.8 https://security.netapp.com/advisory/ntap-20250509-0002
generic_textual CRITICAL https://security.netapp.com/advisory/ntap-20250509-0002
cvssv3.1 9.8 https://weblog.rubyonrails.org/2020/5/18/Rails-5-2-4-3-and-6-0-3-1-have-been-released
generic_textual CRITICAL https://weblog.rubyonrails.org/2020/5/18/Rails-5-2-4-3-and-6-0-3-1-have-been-released
cvssv3.1 9.8 https://www.debian.org/security/2020/dsa-4766
generic_textual CRITICAL https://www.debian.org/security/2020/dsa-4766
Reference id Reference type URL
http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00031.html
http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00034.html
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-8165.json
https://api.first.org/data/v1/epss?cve=CVE-2020-8165
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15169
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8162
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8164
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8165
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8166
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8167
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activesupport/CVE-2020-8165.yml
https://groups.google.com/forum/#!topic/rubyonrails-security/bv6fW4S0Y1c
https://groups.google.com/g/rubyonrails-security/c/bv6fW4S0Y1c
https://hackerone.com/reports/413388
https://lists.debian.org/debian-lts-announce/2020/06/msg00022.html
https://lists.debian.org/debian-lts-announce/2020/07/msg00013.html
https://nvd.nist.gov/vuln/detail/CVE-2020-8165
https://security.netapp.com/advisory/ntap-20250509-0002
https://weblog.rubyonrails.org/2020/5/18/Rails-5-2-4-3-and-6-0-3-1-have-been-released
https://www.debian.org/security/2020/dsa-4766
1843072 https://bugzilla.redhat.com/show_bug.cgi?id=1843072
GHSA-2p68-f74v-9wc6 https://github.com/advisories/GHSA-2p68-f74v-9wc6
RHSA-2021:1313 https://access.redhat.com/errata/RHSA-2021:1313
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00031.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00034.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-8165.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activesupport/CVE-2020-8165.yml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://groups.google.com/forum/#!topic/rubyonrails-security/bv6fW4S0Y1c
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://groups.google.com/g/rubyonrails-security/c/bv6fW4S0Y1c
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://hackerone.com/reports/413388
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://lists.debian.org/debian-lts-announce/2020/06/msg00022.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://lists.debian.org/debian-lts-announce/2020/07/msg00013.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2020-8165
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://security.netapp.com/advisory/ntap-20250509-0002
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://weblog.rubyonrails.org/2020/5/18/Rails-5-2-4-3-and-6-0-3-1-have-been-released
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://www.debian.org/security/2020/dsa-4766
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.99603
EPSS Score 0.90128
Published At May 29, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-05-29T09:11:52.529124+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/05/GHSA-2p68-f74v-9wc6/GHSA-2p68-f74v-9wc6.json 38.6.0