CVE-2013-0277: Rubyonrails Rails

High severity, CVSS 10.0. EPSS: 7.5% chance of exploitation in the next 30 days.

ActiveRecord in Ruby on Rails before 2.3.17 and 3.x before 3.1.0 allows remote attackers to cause a denial of service or execute arbitrary code via crafted serialized attributes that cause the +serialize+ helper to deserialize arbitrary YAML.

Affected products

• Rubyonrails Rails: version 3.0.0 only; version 3.0.1 only; version 3.0.2 only; version 3.0.3 only; version 3.0.4 only; version 3.0.5 only; …
• Rubyonrails Ruby On Rails: version 3.0.4 only

Published 2013-02-13. Last modified 2026-06-16.