ACTIONPACK · GHSA-wm3x-v3qw-4jh3 · Package
FIX → 8.1.4.1 +1
Action Pack's ActionController::Parameters#each_key returns an internal hash instead of the Parameters object when called with a block. Mass assignment then accepts that hash without the permitted check, so an attacker can set attributes the application does not allow, such as an authorization flag.
first public Nov 4, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Only Rails applications that pass the return value of Parameters#each_key, called with a block, into mass assignment are exposed. The advisory states Rails itself makes no such call, so applications that do not use that pattern are not affected by this path.
Not affected if no-each-key-in-mass-assignment, not-rails
Who cares actionpack, rails, ruby, web-app
bundle exec ruby -e "require 'action_pack'; puts ActionPack::VERSION::STRING" or check Gemfile.lock for actionpack below 8.0.5.2 or in 8.1.x below 8.1.4.1each_key calls whose return value is passed to , or ActionController::Parameters#each_key delegates to the internal ActiveSupport::HashWithIndifferentAccess that holds the request parameters, so when called with a block it returns that hash instead of the Parameters instance. The hash does not respond to permitted?, so Active Model mass assignment (new, assign_attributes, update) accepts it without raising ActiveModel::ForbiddenAttributesError. An application that passes the return value of each_key to mass assignment could allow a remote, unauthenticated attacker to set attributes that the application does not permit, such as an authorization flag.
This is an incomplete fix of CVE-2020-8164, which made each, each_pair and each_value return the instance but left delegated.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
newassign_attributesupdateUpgrade to 8.1.4.1 +1
8.1.4.1 for the 8.1 line8.0.5.2 for the 8.0 lineParameterseach_keyThe fixed releases define Parameters#each_key to yield each key and return the Parameters instance when given a block, as each, each_pair and each_value do, and to return an Enumerator without one. Code that used the return value of each_key as a hash now receives the Parameters instance, which mass assignment rejects unless it is permitted.
An application is affected if it passes the return value of ActionController::Parameters#each_key, called with a block, to mass assignment. Rails itself makes no such call.
Do not use the return value of each_key. Call it for its block only, and pass the permitted Parameters instance to mass assignment.
The fixed releases are available at the normal locations.
Patches for those who cannot upgrade at once:
This issue was responsibly reported by HackerOne researcher smlee.