Description
Ruby on Rails web applications that pass unverified user input to the render method in a controller or a view may be vulnerable to a code injection.
Remediation
All users running an affected release should either upgrade or use one of the workarounds immediately. A workaround to this issue is to not pass arbitrary user input to the render method. Instead, verify that data before passing it to the render method. Consult Web references for more information about this issue.
References
Related Vulnerabilities
ForgeRock AM / OpenAM Deserialization RCE (CVE-2021-35464)
WordPress Plugin WooCommerce Possible Remote Code Execution (3.5.0)
WordPress Plugin Statistics Remote Code Execution (1.8)
WordPress Plugin Feedify Remote Code Execution (2.0.0)
WordPress Plugin WP-Live Chat by 3CX Remote Code Execution (7.0.01)