CVE-2023-22794: Activerecord Project Activerecord

High severity, CVSS 8.8. EPSS: 2.2% chance of exploitation in the next 30 days.

A vulnerability in ActiveRecord <6.0.6.1, v6.1.7.1 and v7.0.4.1 related to the sanitization of comments. If malicious user input is passed to either the `annotate` query method, the `optimizer_hints` query method, or through the QueryLogs interface which automatically adds annotations, it may be sent to the database withinsufficient sanitization and be able to inject SQL outside of the comment.

Affected products

• Activerecord Project Activerecord: from 6.0.0, before 6.0.6.1 (fixed in 6.0.6.1); from 6.1.0, before 6.1.7.1 (fixed in 6.1.7.1); from 7.0.0, before 7.0.4.1 (fixed in 7.0.4.1)

Published 2023-02-09. Last modified 2026-06-17.