CVE-2016-2098: Ruby on Rails Action Pack render method remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable remote code execution with a very high EPSS score and public exploit code makes this an urgent patch target despite no KEV listing.

What it is

Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 permits remote code execution when an application uses the render method with attacker-influenced input. The flaw is improper input validation (CWE-20) that lets crafted requests reach Ruby code execution, which matters because Rails is widely deployed and the affected render pattern is common in application code.

Impact

An unauthenticated remote attacker can execute arbitrary Ruby code in the context of the Rails application, leading to full compromise of the application server and any data or credentials it can reach.

Attack surface

Reached over the network via HTTP requests to an application endpoint that passes user-controlled input into the render method; the CVSS vector shows no privileges and no user interaction required, though exploitation depends on the application actually exposing that pattern.

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.81445, 99.62nd percentile) and a public Exploit-DB entry (40086) exists, indicating mature public exploitation.

What to do

• Upgrade Rails to 3.2.22.2, 4.1.14.2, 4.2.5.2 or later as described in the vendor advisory
• Apply the Debian DSA-3509 or openSUSE updates if Rails is installed from distribution packages
• Audit application code for render calls that accept user-controlled parameters and remove or strictly whitelist those inputs
• Where immediate upgrade is impossible, block or sanitize request parameters reaching render and restrict outbound network access from the application server

Detection

• Search application and web logs for requests containing render-related parameters with Ruby code patterns or unusual file paths
• Monitor for unexpected child processes, shell execution or outbound connections spawned by the Rails application process
• Alert on errors or stack traces referencing render with attacker-supplied input in production logs

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.