Search for vulnerabilities
| Vulnerability ID | VCID-carc-ntrd-ebfe |
| Aliases |
CVE-2013-0156
GHSA-jmgw-6vjg-jjwg OSV-89026 |
| Summary | Multiple vulnerabilities in parameter parsing in Action Pack There are multiple weaknesses in the parameter parsing code for Ruby on Rails which allows attackers to bypass authentication systems, inject arbitrary SQL, inject and execute arbitrary code, or perform a DoS attack on a Rails application. |
| Status | Published |
| Exploitability | 2.0 |
| Weighted Severity | 8.0 |
| Risk | 10.0 |
| Affected and Fixed Packages | Package Details |
| Data source | Exploit-DB |
|---|---|
| Date added | Jan. 10, 2013 |
| Description | Ruby on Rails - XML Processor YAML Deserialization Code Execution (Metasploit) |
| Ransomware campaign use | Known |
| Source publication date | Jan. 10, 2013 |
| Exploit type | remote |
| Platform | multiple |
| Source update date | Jan. 10, 2013 |
| Data source | Metasploit |
|---|---|
| Description | This module exploits a remote code execution vulnerability in the XML request processor of the Ruby on Rails application framework. This vulnerability allows an attacker to instantiate a remote object, which in turn can be used to execute any ruby code remotely in the context of the application. This module has been tested across multiple versions of RoR 3.x and RoR 2.x The technique used by this module requires the target to be running a fairly recent version of Ruby 1.9 (since 2011 or so). Applications using Ruby 1.8 may still be exploitable using the init_with() method, but this has not been demonstrated. |
| Note | Reliability: - unknown-reliability Stability: - unknown-stability SideEffects: - unknown-side-effects |
| Ransomware campaign use | Unknown |
| Source publication date | Jan. 7, 2013 |
| Platform | Ruby |
| Source URL | https://github.com/rapid7/metasploit-framework/tree/master/modules/exploits/multi/http/rails_xml_yaml_code_exec.rb |
| Exploitability (E) | Access Vector (AV) | Access Complexity (AC) | Authentication (Au) | Confidentiality Impact (C) | Integrity Impact (I) | Availability Impact (A) |
|---|---|---|---|---|---|---|
high functional unproven proof_of_concept not_defined |
local adjacent_network network |
high medium low |
multiple single none |
none partial complete |
none partial complete |
none partial complete |
| Percentile | 0.99689 |
| EPSS Score | 0.91907 |
| Published At | April 2, 2026, 12:55 p.m. |
| Date | Actor | Action | Source | VulnerableCode Version |
|---|---|---|---|---|
| 2026-04-01T12:46:47.865323+00:00 | GitLab Importer | Import | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/gem/actionpack/CVE-2013-0156.yml | 38.0.0 |