cve.bz

CVE-2022-35956

9.8 criticalEPSS 0.6%

Critical (9.8) in update by case project update by case. EPSS 0.6% chance of exploitation in the next 30 days. Fixed in update_by_case 0.1.3.

This Rails gem adds two methods to the ActiveRecord::Base class that allow you to update many records on a single database hit, using a case sql statement for it. Before version 0.1.3 `update_by_case` gem used custom sql strings, and it was not sanitized, making it vulnerable to sql injection. Upgrade to version >= 0.1.3 that uses `Arel` instead to construct the resulting sql statement, with sanitized sql.

Severity

CVSS 3.1

9.8 critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
0.6% chance of exploitation in the next 30 days; higher than 51% of CVEs (scores of 2026-10-31)
CWE
CWE-89
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-33wh-w4m7-c6r8RubyGemsupdate_by_case<0.1.30.1.3

References

Check your stackJSON