{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/action-pack--8.1.4.1--8.0.5.2/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ruby_on_rails:action_pack:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-126081"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Action Pack (\u003c 8.1.4.1, \u003c 8.0.5.2)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Ruby on Rails"],"content_html":"\u003cp\u003eRuby on Rails' Action Pack component contains a vulnerability in \u003ccode\u003eActionController::Parameters#each_key\u003c/code\u003e where the method returns the internal \u003ccode\u003eActiveSupport::HashWithIndifferentAccess\u003c/code\u003e hash instead of the \u003ccode\u003eParameters\u003c/code\u003e instance when invoked with a block. Because this returned hash lacks the \u003ccode\u003epermitted?\u003c/code\u003e method, it is not rejected by Active Model mass assignment mechanisms.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eAn application that passes the return value of \u003ccode\u003eeach_key\u003c/code\u003e to mass assignment (such as \u003ccode\u003enew\u003c/code\u003e, \u003ccode\u003eassign_attributes\u003c/code\u003e, or \u003ccode\u003eupdate\u003c/code\u003e) could allow a remote, unauthenticated attacker to set attributes that the application does not permit, such as an authorization flag.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003eDevelopers should avoid using the return value of \u003ccode\u003eeach_key\u003c/code\u003e and ensure only permitted \u003ccode\u003eParameters\u003c/code\u003e instances are provided to mass assignment methods.\u003c/p\u003e\n","date_modified":"2026-11-13T04:57:41Z","date_published":"2026-11-13T04:57:41Z","id":"https://feed.craftedsignal.io/briefs/2026-11-actionpack-parameters-bypass-ghsa-wm3x-v3qw-4jh3/","summary":"The Action Pack component in Ruby on Rails incorrectly handles the return value of the each_key method, which may allow attackers to bypass Active Model mass assignment protections.","title":"Action Pack: Parameters#each_key mass assignment bypass (CVE-2026-126081)","url":"https://feed.craftedsignal.io/briefs/2026-11-actionpack-parameters-bypass-ghsa-wm3x-v3qw-4jh3/"}],"language":"en","title":"CraftedSignal Threat Feed - Action Pack (\u003c 8.1.4.1, \u003c 8.0.5.2)","version":"https://jsonfeed.org/version/1.1"}