CVE-2022-35956

This Rails gem adds two methods to the ActiveRecord::Base class that allow you to update many records on a single database hit, using a case sql statement for it. Before version 0.1.3 `update_by_case` gem used custom sql strings, and it was not sanitized, making it vulnerable to sql injection. Upgrade to version >= 0.1.3 that uses `Arel` instead to construct the resulting sql statement, with sanitized sql.

• CWE-89

• https://github.com/camilova/activerecord-update-by-case/releases/tag/v0.1.3-stableRelease Notes, Third Party Advisory
• https://github.com/camilova/activerecord-update-by-case/security/advisories/GHSA-33wh-w4m7-c6r8Third Party Advisory
• https://github.com/camilova/activerecord-update-by-case/releases/tag/v0.1.3-stableRelease Notes, Third Party Advisory
• https://github.com/camilova/activerecord-update-by-case/security/advisories/GHSA-33wh-w4m7-c6r8Third Party Advisory

Published

Aug 12, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-3595A vulnerability was found in Linux Kernel. It has been rated…5.5
• CVE-2022-35950OroCommerce is an open-source Business to Business Commerce …4.8
• CVE-2022-35951Redis is an in-memory database that persists on disk. Versio…9.8
• CVE-2022-35952TensorFlow is an open source platform for machine learning. …7.5
• CVE-2022-35953BookWyrm is a social network for tracking your reading, talk…6.1
• CVE-2022-35954The GitHub Actions ToolKit provides a set of packages to mak…5
• CVE-2022-35957Grafana is an open-source platform for monitoring and observ…6.6
• CVE-2022-35958Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2022-35959TensorFlow is an open source platform for machine learning. …7.5
• CVE-2022-3596An information leak was found in OpenStack's undercloud. Thi…7.5
• CVE-2022-35960TensorFlow is an open source platform for machine learning. …7.5
• CVE-2022-35961OpenZeppelin Contracts is a library for secure smart contrac…6.5