-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| activesupport | rubygems | >= 7.0.0, < 7.0.4.3 | 7.0.4.3 |
| activesupport | rubygems | < 6.1.7.3 | 6.1.7.3 |
Miggo AIRoot Cause AnalysisThe vulnerability arises because Ruby 3.2's new bytesplice method was not overridden by ActiveSupport's SafeBuffer to handle HTML safety tagging. Prior to the patch, calling bytesplice on a SafeBuffer (marked as html_safe) would mutate the string without escaping the input or revoking the safe flag. The commit diff shows the addition of a custom bytesplice method in SafeBuffer to enforce escaping, confirming the unpatched version lacked this critical safety check. The vulnerability documentation explicitly identifies bytesplice as the entry point for the exploit.