CVE-2025-55193 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	NIST	UNKNOWN				---
GitHub_M	CNA	---				---

Awaiting analysis

This vulnerability is currently awaiting analysis.

Base Score

CVSS 3.x

EPSS Score

Percentile: Unknown

Debian Releases

Debian Product

Codename

rails

bullseye (security)	vulnerable
bullseye	vulnerable
bookworm	vulnerable
bookworm (security)	vulnerable
forky	vulnerable
sid	vulnerable
trixie	vulnerable

Common Weakness Enumeration

CWE-150 - Improper Neutralization of Escape, Meta, or Control Sequences
The software receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as escape, meta, or control character sequences when they are sent to a downstream component.

Vulnerability Media Exposure

[GERMAN] Ruby on Rails: Mehrere Schwachstellen
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Ruby on Rails ausnutzen, um beliebigen Programmcode auszuführen und Daten zu manipulieren.
Published: 2025-08-13T22:00:00+00:00

References

https://github.com/rails/rails/commit/3beef20013736fd52c5dcfdf061f7999ba318290

https://github.com/rails/rails/commit/568c0bc2f1e74c65d150a84b89a080949bf9eb9b

https://github.com/rails/rails/commit/6a944ca4805e72050a0fbb1a461534eb760d3202

https://github.com/rails/rails/security/advisories/GHSA-76r7-hhxj-r776