$ cve CVE-2013-0156 JSON

CVE-2013-0156 EXPLOIT

7.5

HIGH · CVSS 2.0 · EPSS 99.4% (pctl 100)

Patch early

A public exploit exists.

Description

active_support/core_ext/hash/conversions.rb in Ruby on Rails before 2.3.15, 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion.

Scoring

CVSS	7.5 (HIGH, v2.0)
Vector	AV:N/AC:L/Au:N/C:P/I:P/A:P
EPSS	99.45% — more likely to be exploited than 100% of all CVEs
Weakness	CWE-20
On CISA KEV	no
Public exploit	yes
Published	2013-01-13
Last modified	2026-06-16

Affected (3)

Vendor	Product
debian	debian linux
rubyonrails	rails
rubyonrails	ruby on rails

Public exploits

Source	Title	Date
exploit-db	Ruby on Rails - Known Secret Session Cookie Remote Code Execution (Metasploit)	2013-08-12
exploit-db	Ruby on Rails - XML Processor YAML Deserialization Code Execution (Metasploit)	2013-01-10

References

→ the Explorer · watch your stack · NVD