GHSA-5qw5-wf2q-f538

Suggest an improvement
Source
https://github.com/advisories/GHSA-5qw5-wf2q-f538
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-5qw5-wf2q-f538/GHSA-5qw5-wf2q-f538.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-5qw5-wf2q-f538
Published
2026-01-16T19:20:40Z
Modified
2026-02-03T03:11:34.559768Z
Severity
  • 8.8 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
ActiveRecord-JDBC-Adapter (AR-JDBC) lib/arjdbc/jdbc/adapter.rb sql.gsub() Function SQL Injection
Details

ActiveRecord-JDBC-Adapter (AR-JDBC) contains a flaw that may allow carrying out an SQL injection attack. The issue is due to the sql.gsub() function in lib/arjdbc/jdbc/adapter.rb not properly sanitizing user-supplied input before using it in SQL queries. This may allow a remote attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

Database specific 
{
    "cwe_ids": [
        "CWE-89"
    ],
    "github_reviewed_at": "2026-01-16T19:20:40Z",
    "nvd_published_at": null,
    "severity": "HIGH",
    "github_reviewed": true
}
References

Affected packages

RubyGems / activerecord-jdbc-adapter

Package

Name
activerecord-jdbc-adapter
Purl
pkg:gem/activerecord-jdbc-adapter

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.2.8

Affected versions

0.*
0.6
0.7
0.7.1
0.7.2
0.8
0.8.1
0.8.2
0.9
0.9.0.1
0.9.1
0.9.2
0.9.3
0.9.4
0.9.5
0.9.6
0.9.7
1.*
1.0.0.beta1
1.0.0.beta2
1.0.0
1.0.1
1.0.2
1.0.3
1.1.0
1.1.1
1.1.2
1.1.3
1.2.0
1.2.1
1.2.2
1.2.2.1
1.2.5

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-5qw5-wf2q-f538/GHSA-5qw5-wf2q-f538.json"