{
  "cveId": "CVE-2023-22794",
  "url": "https://patchblox.com/security/cve/CVE-2023-22794",
  "summary": "CVE-2023-22794 is fixed in rails on 1 platform, first by DEBIAN-CVE-2023-22794, released February 9, 2023. It is not reported as exploited. Patch Radar priority: High.",
  "title": "rails: A vulnerability in ActiveRecord \u003C6.0.6.1, v6.1.7.1 and v7.0.4.1 related to the sanitization of comments",
  "description": "A vulnerability in ActiveRecord \u003C6.0.6.1, v6.1.7.1 and v7.0.4.1 related to the sanitization of comments. If malicious user input is passed to either the \u0060annotate\u0060 query method, the \u0060optimizer_hints\u0060 query method, or through the QueryLogs interface which automatically adds annotations, it may be sent to the database withinsufficient sanitization and be able to inject SQL outside of the comment.",
  "published": "2023-02-09T20:15:11Z",
  "severity": "high",
  "cvss": 8.8,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "epss": 0.02153,
  "epssPercentile": 0.82273,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "rails",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "2:6.1.7.3\u002Bdfsg-1",
      "fix": "DEBIAN-CVE-2023-22794",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2023-22794",
      "released": "2023-02-09T20:15:11Z"
    },
    {
      "platform": "linux",
      "product": "rails",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "2:6.1.7.3\u002Bdfsg-1",
      "fix": "DEBIAN-CVE-2023-22794",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2023-22794",
      "released": "2023-02-09T20:15:11Z"
    },
    {
      "platform": "linux",
      "product": "rails",
      "release": "Debian 14",
      "fixedVersion": "2:6.1.7.3\u002Bdfsg-1",
      "fix": "DEBIAN-CVE-2023-22794",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2023-22794",
      "released": "2023-02-09T20:15:11Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T19:12:23Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}