---
id: "GHSA-wm3x-v3qw-4jh3"
page: "https://infrastack.ai/live/GHSA-wm3x-v3qw-4jh3"
kind: "vulnerability"
aliases: ["GHSA-wm3x-v3qw-4jh3"]
title: "Possible Strong Parameters bypass in Parameters#each_key in Action Pack"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "actionpack", "fixed": ["8.1.4.1"], "affected": ">= 8.1, < 8.1.4.1", "ecosystem": "rubygems"}, {"name": "actionpack", "fixed": ["8.0.5.2"], "affected": "< 8.0.5.2", "ecosystem": "rubygems"}]
ecosystems: ["rubygems"]
tags: ["actionpack", "cwe-915", "package", "rails", "ruby", "web-app"]
not_affected_if: ["no-each-key-in-mass-assignment", "not-rails"]
published_at: "2026-11-04T03:02:14+00:00"
first_seen_at: "2026-11-09T22:53:29+00:00"
updated_at: "2026-11-09T22:54:19+00:00"
sources: [{"source": "ghsa-repo", "url": "https://github.com/rails/rails/security/advisories/GHSA-wm3x-v3qw-4jh3", "first_seen_at": "2026-11-09T22:53:29+00:00"}]
exploit_sources: []
---

# Possible Strong Parameters bypass in Parameters#each_key in Action Pack

Link for people: https://infrastack.ai/live/GHSA-wm3x-v3qw-4jh3 (this .md is for agents)

Action Pack's ActionController::Parameters#each_key returns an internal hash instead of the Parameters object when called with a block. Mass assignment then accepts that hash without the permitted check, so an attacker can set attributes the application does not allow, such as an authorization flag.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- rubygems:actionpack affected >= 8.1, < 8.1.4.1 fixed 8.1.4.1
- rubygems:actionpack affected < 8.0.5.2 fixed 8.0.5.2

## How to check

- Run `bundle exec ruby -e "require 'action_pack'; puts ActionPack::VERSION::STRING"` or check Gemfile.lock for `actionpack` below `8.0.5.2` or in `8.1.x` below `8.1.4.1`
- Search the application code for `each_key` calls whose return value is passed to `new`, `assign_attributes` or `update`

## Fix

- actionpack `8.1.4.1` for the 8.1 line
- actionpack `8.0.5.2` for the 8.0 line
- Patch commits for those who cannot upgrade yet are linked in the advisory (8.1 and 8.0 commits)

## Timeline

- 2026-11-09T22:53:29+00:00 ghsa-repo https://github.com/rails/rails/security/advisories/GHSA-wm3x-v3qw-4jh3

## Documents

- [advisory] Maintainer's advisory: github.com https://github.com/rails/rails/security/advisories/GHSA-wm3x-v3qw-4jh3

## From the sources

### Impact
`ActionController::Parameters#each_key` delegates to the internal `ActiveSupport::HashWithIndifferentAccess` that holds the request parameters, so when called with a block it returns that hash instead of the `Parameters` instance. The hash does not respond to `permitted?`, so Active Model mass assignment (`new`, `assign_attributes`, `update`) accepts it without raising `ActiveModel::ForbiddenAttributesError`. An application that passes the return value of `each_key` to mass assignment could allow a remote, unauthenticated attacker to set attributes that the application does not permit, such as an authorization flag.

This is an incomplete fix of [CVE-2020-8164](https://github.com/advisories/GHSA-8727-m6gj-mc37), which made `each`, `each_pair` and `each_value` return the `Parameters` instance but left `each_key` delegated.

### Details
The fixed releases define `Parameters#each_key` to yield each key and return the `Parameters` instance when given a block, as `each`, `each_pair` and `each_value` do, and to return an `Enumerator` without one. Code that used the return value of `each_key` as a hash now receives the `Parameters` instance, which mass assignment rejects unless it is permitted.

### Affected applications
An application is affected if it passes the return value of `ActionController::Parameters#each_key`, called with a block, to mass assignment. Rails itself makes no such call.

### Workarounds
Do not use the return value of `each_key`. Call it for its block only, and pass the permitted `Parameters` instance to mass assignment.

### Releases
The fixed releases are available at the normal locations.

Patches for those who cannot upgrade at once:
- 8.1: https://github.com/rails/rails/commit/8ba746e0a786458c281060823f2ccc5c5f6312ac.patch
- 8.0: https://github.com/rails/rails/commit/2fc8838300133931e19eed3ea6cee76a7e83f19c.patch

### Versions affected
- actionpack < 8.0.5.2
- actionpack >= 8.1, < 8.1.4.1

### Credit
This issue was responsibly reported by HackerOne researcher [smlee](https://hackerone.com/smlee).

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_