Medium severity5.8NVD Advisory· Published Aug 12, 2022· Updated Jun 17, 2026
CVE-2022-35956
CVE-2022-35956
Description
This Rails gem adds two methods to the ActiveRecord::Base class that allow you to update many records on a single database hit, using a case sql statement for it. Before version 0.1.3 update_by_case gem used custom sql strings, and it was not sanitized, making it vulnerable to sql injection. Upgrade to version >= 0.1.3 that uses Arel instead to construct the resulting sql statement, with sanitized sql.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
update_by_caseRubyGems | < 0.1.3 | 0.1.3 |
Affected products
3- cpe:2.3:a:update_by_case_project:update_by_case:*:*:*:*:*:ruby:*:*Range: <0.1.3
- Range: < 0.1.3
Patches
Vulnerability mechanics
References
5- github.com/advisories/GHSA-33wh-w4m7-c6r8ghsaADVISORY
- github.com/camilova/activerecord-update-by-case/releases/tag/v0.1.3-stablenvdRelease NotesThird Party AdvisoryWEB
- github.com/camilova/activerecord-update-by-case/security/advisories/GHSA-33wh-w4m7-c6r8nvdThird Party AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2022-35956ghsaADVISORY
- github.com/rubysec/ruby-advisory-db/blob/master/gems/update_by_case/CVE-2022-35956.ymlghsaWEB
News mentions
0No linked articles in our index yet.