{"id":"CVE-2020-8165","aliases":["GHSA-2p68-f74v-9wc6"],"url":"https://o3.security/vulnerability/CVE-2020-8165","summary":"ActiveSupport potentially unintended unmarshalling of user-provided objects in MemCacheStore and RedisCacheStore","details":"In ActiveSupport, there is potentially unexpected behaviour in the MemCacheStore and RedisCacheStore where, when\nuntrusted user input is written to the cache store using the `raw: true` parameter, re-reading the result\nfrom the cache can evaluate the user input as a Marshalled object instead of plain text. Vulnerable code looks like:\n\n```\ndata = cache.fetch(\"demo\", raw: true) { untrusted_string }\n```\nVersions Affected:  rails < 5.2.5, rails < 6.0.4\nNot affected:       Applications not using MemCacheStore or RedisCacheStore. Applications that do not use the `raw` option when storing untrusted user input.\nFixed Versions:     rails >= 5.2.4.3, rails >= 6.0.3.1\n  \nImpact\n------\nUnmarshalling of untrusted user input can have impact up to and including RCE. At a minimum,\nthis vulnerability allows an attacker to inject untrusted Ruby objects into a web application.\nIn addition to upgrading to the latest versions of Rails, developers should ensure that whenever\nthey are calling `Rails.cache.fetch` they are using consistent values of the `raw` parameter for both\nreading and writing, especially in the case of the RedisCacheStore which does not, prior to these changes,\ndetect if data was serialized using the raw option upon deserialization.\n\nWorkarounds\n-----------\nIt is recommended that application developers apply the suggested patch or upgrade to the latest release as\nsoon as possible. If this is not possible, we recommend ensuring that all user-provided strings cached using\nthe `raw` argument should be double-checked to ensure that they conform to the expected format.","published":"2020-06-19T18:15:11.067Z","modified":"2026-09-09T03:30:25.000642267Z","cvss":{"score":9.8,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"epss":{"score":0.45732,"percentile":0.98744,"asOf":"2026-08-23"},"cisaKev":null,"exploitsKnown":5,"affectedPackages":[{"ecosystem":"RubyGems","name":"activesupport","fixedVersion":"5.2.4.3"},{"ecosystem":"RubyGems","name":"activesupport","fixedVersion":"6.0.3.1"}],"fix":null,"references":[{"type":"ADVISORY","url":"http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00031.html"},{"type":"ADVISORY","url":"http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00034.html"},{"type":"ADVISORY","url":"https://lists.debian.org/debian-lts-announce/2020/06/msg00022.html"},{"type":"ADVISORY","url":"https://lists.debian.org/debian-lts-announce/2020/07/msg00013.html"},{"type":"ADVISORY","url":"https://security.netapp.com/advisory/ntap-20250509-0002/"},{"type":"ADVISORY","url":"https://weblog.rubyonrails.org/2020/5/18/Rails-5-2-4-3-and-6-0-3-1-have-been-released/"},{"type":"ADVISORY","url":"https://www.debian.org/security/2020/dsa-4766"},{"type":"FIX","url":"https://groups.google.com/g/rubyonrails-security/c/bv6fW4S0Y1c"},{"type":"FIX","url":"https://hackerone.com/reports/413388"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-8165"},{"type":"WEB","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activesupport/CVE-2020-8165.yml"},{"type":"WEB","url":"https://groups.google.com/forum/#!topic/rubyonrails-security/bv6fW4S0Y1c"},{"type":"WEB","url":"https://security.netapp.com/advisory/ntap-20250509-0002"},{"type":"WEB","url":"https://weblog.rubyonrails.org/2020/5/18/Rails-5-2-4-3-and-6-0-3-1-have-been-released"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-09-09T03:30:25.000642267Z"}}