Backend framework
Ruby on Rails: supported versions and open vulnerabilities today
Ruby on Rails 8.1 and 8.0 are supported (8.0 until Nov 7, 2026); 7.2 reached end of life on Aug 9, 2026; the latest release is 8.1.4. 2 high or critical advisories for Ruby on Rails were published in the last 12 months; 3 advisories (CVE-2019-5418, CVE-2014-0130 and more) are on CISA’s list of vulnerabilities exploited in the wild.
Last checked against endoflife.date, OSV.dev, CISA KEV, FIRST EPSS and deps.dev.
- Latest release
- 8.1.4
- GitHub stars
- 58.8k
- Licence
- MIT
- OpenSSF Scorecard
- 6.3 / 10
Supported versions
Security advisories
11 advisories published in the last 12 months, 2 of them high or critical. 130 in total since records began. Checked packages: rails, railties, actionpack, actionview, activerecord, activesupport and activestorage.
Older advisories CISA lists as exploited in the wild
- CVE-2019-5418 added ; fixed in 4.2.11.1, 5.0.7.2, 5.1.6.2 and 5.2.2.1.
- CVE-2014-0130 added ; fixed in 3.2.18, 4.0.5 and 4.1.1.
- CVE-2016-0752 added ; fixed in 3.2.22.1, 4.1.14.1 and 4.2.5.1.
Active Storage has possible arbitrary file read and remote code execution in Active Storage variant processing
Fixed in 7.2.3.2, 8.0.5.1 and 8.1.3.1.
Affects activestorage.
EPSS: top 2%Rails Active Storage has possible Path Traversal in DiskService
Fixed in 7.2.3.1, 8.0.4.1 and 8.1.2.1.
Affects activestorage.
EPSS: top 55%
All rails advisories on OSV.devAll railties advisories on OSV.devAll actionpack advisories on OSV.devAll actionview advisories on OSV.devAll activerecord advisories on OSV.devAll activesupport advisories on OSV.devAll activestorage advisories on OSV.dev
Maintenance and supply chain
OpenSSF Scorecard 6.3 / 10 (scored )
The Scorecard rates the repository’s security practices, not known vulnerabilities. Recent activity: 30 commits and 4 issue updates found in the last 90 days.
Weakest checks
- No static analysis (SAST 0/10)
- No fuzzing (Fuzzing 0/10)
- Unpinned build dependencies (Pinned-Dependencies 2/10)
Alternatives
Express.js
Minimal Node.js web framework
Strengths
- Lightweight and flexible
- Huge ecosystem
Trade-offs
- Minimal built-in features
- Manual setup required
Django
High-level Python web framework with batteries included
Strengths
- Comprehensive built-in features (ORM, admin, auth)
- Secure by default (CSRF, SQL injection protection)
Trade-offs
- Monolithic and opinionated
- Slower than lightweight frameworks
FastAPI
Modern Python framework for building APIs with type hints
Strengths
- Extremely fast performance (on par with Node/Go)
- Automatic API documentation (OpenAPI/Swagger)
Trade-offs
- Younger ecosystem than Django/Flask
- Less built-in features than Django
Spring Boot
Java framework for building production-ready applications
Strengths
- Enterprise-grade with robust ecosystem
- Comprehensive security and transaction management
Trade-offs
- Verbose compared to modern frameworks
- Steep learning curve for beginners
Example stacks with Ruby on Rails
Docs and release notes
Check Ruby on Rails in your own stack
This page checks Ruby on Rails in general. Your repo pins specific versions: the free dependency check reads your manifests and lists what to fix first. Prism Agent runs the same live checks on your whole stack and turns them into a plan your coding agent can build.