CVE-2021-21305: Carrierwave Project Carrierwave

High severity, CVSS 8.8. EPSS: 12.7% chance of exploitation in the next 30 days.

CarrierWave is an open-source RubyGem which provides a simple and flexible way to upload files from Ruby applications. In CarrierWave before versions 1.3.2 and 2.1.1, there is a code injection vulnerability. The "#manipulate!" method inappropriately evals the content of mutation option(:read/:write), allowing attackers to craft a string that can be executed as a Ruby code. If an application developer supplies untrusted inputs to the option, it will lead to remote code execution(RCE). This is fixed in versions 1.3.2 and 2.1.1.

Affected products

• Carrierwave Project Carrierwave: before 1.3.2 (fixed in 1.3.2); from 2.0.1, before 2.1.1 (fixed in 2.1.1)

Published 2021-02-08. Last modified 2026-06-17.