CVE-2013-0156: Ruby on Rails XML parameter parsing allows object injection and code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityUnauthenticated remote code execution with an EPSS probability above 0.99 and public exploitation tooling makes this an urgent patching priority.

What it is

Ruby on Rails fails to properly restrict casts of string values in active_support/core_ext/hash/conversions.rb, allowing remote attackers to perform object-injection attacks and execute arbitrary code. The flaw also permits denial of service through nested XML entity references that consume memory and CPU. It affects Rails before 2.3.15, 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11.

Impact

An unauthenticated remote attacker can execute arbitrary code in the context of the Rails application or exhaust server memory and CPU to cause a denial of service.

Attack surface

Reached over the network via HTTP requests that supply crafted XML or YAML/Symbol type-converted parameters to Action Pack; no authentication or user interaction is required per the AV:N/AC:L/Au:N vector.

Exploitation

Not listed in CISA KEV, but EPSS is 0.99449 (99.942 percentile), indicating near-certain exploitation activity; references include a Metasploit blog post on serialization exploitation, and no ransomware group usage is documented.

What to do

• Upgrade Rails to 2.3.15, 3.0.19, 3.1.10, 3.2.11 or later, or apply the vendor patch for your branch
• Apply the official workaround disabling XML parameter parsing (action_dispatch request parameter parsing) if immediate upgrade is not possible
• Apply distribution vendor updates for Debian, Red Hat, and other affected packages
• Disable or restrict YAML and Symbol type conversion in incoming request parameters
• Review and limit XML entity expansion in any XML parsing paths

Detection

• Monitor HTTP requests containing XML bodies with nested entity references or YAML/Symbol type tags
• Alert on Rails application processes spawning unexpected child processes or shell commands
• Track spikes in memory and CPU usage correlated with XML-heavy request patterns
• Search logs for Action Pack parameter parsing errors or exceptions involving YAML or Symbol conversion

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.