How severe is GHSA-5qw5-wf2q-f538?

No CVSS score has been assigned to GHSA-5qw5-wf2q-f538 yet. Review the advisory details and affected package list to assess your exposure.

Which packages are affected by GHSA-5qw5-wf2q-f538?

GHSA-5qw5-wf2q-f538 affects the following packages: activerecord-jdbc-adapter (RubyGems). Ecosystems affected: RubyGems.

How do I fix GHSA-5qw5-wf2q-f538?

Update activerecord-jdbc-adapter to 1.2.8 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-5qw5-wf2q-f538 is resolved across your whole dependency graph.

How do I detect GHSA-5qw5-wf2q-f538 in my RubyGems dependencies?

Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for activerecord-jdbc-adapter, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

How do I mitigate GHSA-5qw5-wf2q-f538 if there is no patch (or I can't update yet)?

Until you can upgrade, make sure every query built from user input uses parameterised statements or a prepared-statement API rather than string concatenation, and reduce the database account's privileges so an injected query cannot read or alter data beyond what the feature needs.

Is GHSA-5qw5-wf2q-f538 actively exploited in the wild?

No public exploit code has been indexed for GHSA-5qw5-wf2q-f538 yet. This does not mean the vulnerability cannot be exploited — absence of public exploits does not imply safety. Apply the recommended fix and use O3 Security to monitor your exposure.

When was GHSA-5qw5-wf2q-f538 published, and has it been updated?

GHSA-5qw5-wf2q-f538 was published on January 16, 2026 and was last updated on February 3, 2026. Advisory data evolves as severity scores, affected ranges, and exploit intelligence are revised — always check the latest version of the advisory before acting.

ActiveRecord-JDBC-Adapter (AR-JDBC) lib/arjdbc/jdbc/adap…

Real-World Exposure

1 pkg affected

💎activerecord-jdbc-adapter

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects RubyGems packages — download data is not available via public APIs for these ecosystems.

Description

ActiveRecord-JDBC-Adapter (AR-JDBC) contains a flaw that may allow carrying out an SQL injection attack. The issue is due to the sql.gsub() function in lib/arjdbc/jdbc/adapter.rb not properly sanitizing user-supplied input before using it in SQL queries. This may allow a remote attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

Affected Packages

1 total 1 fixed

Ecosystem	Package	Vulnerable range	Fix
💎RubyGems	`activerecord-jdbc-adapter`	all versions	1.2.8`bundle update activerecord-jdbc-adapter --conservative`

Detection & mitigation playbook

Open-source dependency

Detect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for activerecord-jdbc-adapter, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update activerecord-jdbc-adapter to 1.2.8 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-5qw5-wf2q-f538 is resolved across your whole dependency graph.
Workarounds
Until you can upgrade, make sure every query built from user input uses parameterised statements or a prepared-statement API rather than string concatenation, and reduce the database account's privileges so an injected query cannot read or alter data beyond what the feature needs.

Frequently Asked Questions

ActiveRecord-JDBC-Adapter (AR-JDBC) contains a flaw that may allow carrying out an SQL injection attack. The issue is due to the sql.gsub() function in lib/arjdbc/jdbc/adapter.rb not properly sanitizing user-supplied input before using it in SQL queries. This may allow a remote attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

O3 Security · Impact-Aware SCA

Is GHSA-5qw5-wf2q-f538 in your dependencies?

Find it across RubyGems, including transitive dependencies.

Scan my dependencies How O3 SCA works

ActiveRecord-JDBC-Adapter (AR-JDBC) lib/arjdbc/jdbc/adapter.rb sql.gsub() Function SQL InjectionGHSA-5qw5-wf2q-f538