Mondoo Vulnerability Intelligence

Curated by Mondoo Research, enhanced with AI

Resources

Search Vulnerabilities
Trending CVEs
Browse Ecosystems
Terminology
Blog

Open Source

cnquery
cnspec

Star us on GitHub!

Company

Mondoo Platform
About
Contact

Vulnerability Intelligence

Customers

Vulnerability IntelligenceGHSA-mpwp-4h2m-765c

GHSA-mpwp-4h2m-765c

MEDIUM6.6

Active Job - Object injection security vulnerability

Published Jan 16, 2026

Modified 1 months ago

Fix available

Details

Active Job vulnerability: An Active Job bug allowed String arguments to be deserialized as if they were Global IDs, an object injection security vulnerability.

Affected Packages

activejob

RubyGems

Fixed in:

4.2.0.beta2

References

WEB

https://advisories.gitlab.com/pkg/gem/activejob/OSVDB-112347

ADVISORY

https://github.com/advisories/GHSA-mpwp-4h2m-765c

PACKAGE

https://github.com/rails/rails

WEB

https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activejob/GHSA-mpwp-4h2m-765c.yml

WEB

https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activejob/OSVDB-112347.yml

CVSS Analysis

CVSS v4.0

6.6

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

LowAC:L

Attack Requirements

NoneAT:N

Privileges Required

NonePR:N

User Interaction

NoneUI:N

Vulnerable System

Vuln. Confidentiality

NoneVC:N

Vuln. Integrity

HighVI:H

Vuln. Availability

NoneVA:N

Subsequent System

Subseq. Confidentiality

NoneSC:N

Subseq. Integrity

NoneSI:N

Subseq. Availability

NoneSA:N

6.6/CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U

Ecosystems

RubyGems

Timeline

PublishedJan 16, 2026

ModifiedJan 20, 2026

GHSA-mpwp-4h2m-765c | Mondoo Vulnerability Intelligence