`activestorage`

Ecosystem:
rubygems

Package URL:
pkg:gem/activestorage

Total PRs:
985 Dependabot PRs

Latest PR:
2 months ago

Unique Repositories:
897 repositories

Unique Repos (30 days):
2 repositories

Security Advisories

Rails Active Storage has a possible DoS vulnerability when in proxy mode via Range requests

GHSA-r46p-8f7g-vvvg CVE-2026-33174 MODERATE published 4 months ago • updated about 20 hours ago

### Impact When serving files through Active Storage's `Blobs::ProxyController`, the controller loads the entire requested byte range into memory b...

Rails Active Storage has possible content type bypass via metadata in direct uploads

GHSA-qcfx-2mfw-w4cg CVE-2026-33173 MODERATE published 4 months ago • updated about 20 hours ago

### Impact Active Storage's `DirectUploadsController` accepts arbitrary metadata from the client and persists it on the blob. Because internal flag...

View all 10 advisories

Recent PRs

RSS Feed

Bump the bundler group across 1 directory with 18 updates

EthanThePhoenix38/openproject #11

8.0.2.1 → 8.0.5 Patch PR

Closed 2 months ago 1 comment

Bump the bundler group across 1 directory with 16 updates

EthanThePhoenix38/openproject #8

8.0.2.1 → 8.0.4.1 Patch PR

Closed 3 months ago 1 comment

Bump the bundler group across 1 directory with 17 updates

LelandParker/openproject #11

8.0.2 → 8.0.4.1 Patch PR

Closed 3 months ago 1 comment

Bump activestorage from 8.0.2 to 8.0.4.1 in /docs

ICB-DCM/cOmicsArt #570

8.0.2 → 8.0.4.1 Patch PR

Closed 3 months ago 2 comments

Bump the bundler group across 4 directories with 8 updates

waveaccounting/activeadmin #18

6.1.7.8 → 8.1.3 Major PR

Closed 4 months ago 1 comment

Bump activestorage from 8.1.2 to 8.1.2.1 in /rails_graphql_federation/search

jeantessier/book-reviews #308

8.1.2 → 8.1.2.1

Closed 4 months ago 3 comments

Bump activestorage from 8.0.4 to 8.0.5

DFE-Digital/teaching-vacancies #8652

8.0.4 → 8.0.5 Patch PR

Open 4 months ago 4 comments

Bump activestorage from 8.1.2 to 8.1.2.1 in /rails_mysql

jeantessier/book-reviews #305

8.1.2 → 8.1.2.1

Closed 4 months ago 3 comments

Build(deps): Bump activestorage from 8.1.2.1 to 8.1.3

abtion/abtion-secret #2783

8.1.2.1 → 8.1.3 Patch PR

Closed 4 months ago 1 comment

:arrow_up: Bump activestorage from 8.1.2.1 to 8.1.3

pglombardo/PasswordPusher #4319

8.1.2.1 → 8.1.3 Patch PR

Open 4 months ago 1 comment

Bump the bundler group across 1 directory with 9 updates

LelandParker/openproject #4

8.0.2 → 8.0.4.1 Patch PR

Closed 4 months ago 1 comment

Bump activestorage from 8.1.2 to 8.1.2.1

unasuke/draft-chamber #31

8.1.2 → 8.1.2.1

Closed 4 months ago 1 comment

chore(deps): bump activestorage from 7.2.2.2 to 7.2.3.1

Bulletdev/prostaff-api #24

7.2.2.2 → 7.2.3.1 Patch PR

Open 4 months ago 4 comments

build(deps): Bump activestorage from 7.2.3 to 7.2.3.1

betagouv/mon-suivi-justice #1441

7.2.3 → 7.2.3.1

Closed 4 months ago 2 comments

Bump activestorage from 7.2.2.2 to 7.2.3.1

NHSDigital/pseudonymisation_service #89

7.2.2.2 → 7.2.3.1 Patch PR

Closed 4 months ago 1 comment

Bump activestorage from 7.2.3 to 7.2.3.1

Betterment/test_track #277

7.2.3 → 7.2.3.1

Open 4 months ago 2 comments

build(deps): bump activestorage from 7.2.3 to 7.2.3.1 in /backend

shiba-mountain/minnaka-map #160

7.2.3 → 7.2.3.1

Open 4 months ago 1 comment

Bump activestorage from 7.2.3 to 7.2.3.1

MITLibraries/tacos #327

7.2.3 → 7.2.3.1

Open 4 months ago 1 comment

Bump activestorage from 7.2.3 to 7.2.3.1

psu-libraries/etda_explore #272

7.2.3 → 7.2.3.1

Closed 4 months ago 1 comment

Bump activestorage from 7.2.2.2 to 7.2.3.1

nelsonfigueroa/personal-finance #101

7.2.2.2 → 7.2.3.1 Patch PR

Closed 4 months ago 1 comment

Bump activestorage from 7.2.2.2 to 7.2.3.1

ejedigitalcr/people-lookup-cr #43

7.2.2.2 → 7.2.3.1 Patch PR

Closed 4 months ago 1 comment

Bump activestorage from 7.2.3 to 7.2.3.1

CruGlobal/bill-bucks-generator #153

7.2.3 → 7.2.3.1

Closed 4 months ago 2 comments

Bump activestorage from 7.2.3 to 7.2.3.1 in the bundler group across 1 directory

zendesk/arturo #170

7.2.3 → 7.2.3.1

Closed 4 months ago 1 comment

Bump activestorage from 8.1.2 to 8.1.2.1 in /boilerplate/rails81

hsbt/hsbt #425

8.1.2 → 8.1.2.1

Closed 4 months ago 1 comment

Bump activestorage from 8.1.2 to 8.1.2.1 in /rails_graphql_federation/reviews

jeantessier/book-reviews #304

8.1.2 → 8.1.2.1

Closed 4 months ago 3 comments

chore(deps): bump activestorage from 8.0.4 to 8.0.4.1

QutEcoacoustics/baw-server #948

8.0.4 → 8.0.4.1

Closed 4 months ago 1 comment

chore(deps): bump activestorage from 8.0.4 to 8.0.4.1

Bulletdev/KingsLendas #5

8.0.4 → 8.0.4.1

Open 4 months ago 5 comments

Bump activestorage from 8.0.4 to 8.0.4.1 in /boilerplate/rails80

hsbt/hsbt #423

8.0.4 → 8.0.4.1

Closed 4 months ago 1 comment

Bump activestorage from 8.0.3 to 8.0.4.1

projectcypress/cypress #2026

8.0.3 → 8.0.4.1 Patch PR

Open 4 months ago 1 comment

Bump activestorage from 8.0.2.1 to 8.0.4.1

gcelanji/connected #15

8.0.2.1 → 8.0.4.1 Patch PR

Open 4 months ago 1 comment

chore(deps): bump activestorage from 8.0.3 to 8.0.4.1

hellodhlyn/baql #39

8.0.3 → 8.0.4.1 Patch PR

Closed 4 months ago 1 comment

build(deps): bump activestorage from 8.0.2.1 to 8.0.4.1

CircuitVerse/CircuitVerse #7206

8.0.2.1 → 8.0.4.1 Patch PR

Closed 4 months ago 3 comments

Bump activestorage from 8.0.2.1 to 8.0.4.1

chicago-tool-library/circulate #2128

8.0.2.1 → 8.0.4.1 Patch PR

Closed 4 months ago 1 comment

build(deps): bump activestorage from 8.0.2 to 8.0.4.1

shiroemons/touhou_karaoke_admin #668

8.0.2 → 8.0.4.1 Patch PR

Closed 4 months ago 2 comments

Bump activestorage from 8.1.2 to 8.1.2.1

quintel/etengine #1722

8.1.2 → 8.1.2.1

Closed 4 months ago 1 comment

Bump activestorage from 8.1.2 to 8.1.2.1

unboxed/bops #2980

8.1.2 → 8.1.2.1

Closed 4 months ago 1 comment

Bump activestorage from 8.1.2 to 8.1.2.1

umts/incidents #808

8.1.2 → 8.1.2.1

Closed 4 months ago 1 comment

Bump activestorage from 8.1.2 to 8.1.2.1

merrelltd72/song-tracker #25

8.1.2 → 8.1.2.1

Closed 4 months ago 1 comment

build(deps): bump activestorage from 8.1.2 to 8.1.2.1

stereosupersonic/chickenhouse #226

8.1.2 → 8.1.2.1

Closed 4 months ago 1 comment

build(deps): bump activestorage from 8.1.2 to 8.1.2.1

Crown-Commercial-Service/DataSubmissionService #867

8.1.2 → 8.1.2.1

Closed 4 months ago 2 comments

Bump activestorage from 8.1.2 to 8.1.2.1

hackclub/forge #18

8.1.2 → 8.1.2.1

Closed 4 months ago 4 comments

chore(deps): bump activestorage from 8.1.2 to 8.1.2.1

huwd/learn_hanzi #115

8.1.2 → 8.1.2.1

Closed 4 months ago 1 comment

Bump activestorage from 8.1.2 to 8.1.2.1

muhme/quote #137

8.1.2 → 8.1.2.1

Closed 4 months ago 1 comment

build(deps): bump activestorage from 8.1.2 to 8.1.2.1

nla/nla-blacklight_common #341

8.1.2 → 8.1.2.1

Closed 4 months ago 5 comments

build(deps): bump activestorage from 8.1.2 to 8.1.2.1

vivesvoies/court-message #388

8.1.2 → 8.1.2.1

Closed 4 months ago 2 comments

Bump activestorage from 8.1.2 to 8.1.2.1

bunnymatic/mau #586

8.1.2 → 8.1.2.1

Closed 4 months ago 2 comments

Bump activestorage from 8.1.2 to 8.1.2.1

samuelvaneck/radio_playlists #1955

8.1.2 → 8.1.2.1

Closed 4 months ago 1 comment

Bump activestorage from 8.1.2 to 8.1.2.1

rbazinet/foundry-crm #9

8.1.2 → 8.1.2.1

Closed 4 months ago 1 comment

Bump activestorage from 8.1.2 to 8.1.2.1

edgi-govdata-archiving/web-monitoring-db #1368

8.1.2 → 8.1.2.1

Closed 4 months ago 1 comment

chore(deps): bump activestorage from 8.1.2 to 8.1.2.1

3cityRUG/TRUG #111

8.1.2 → 8.1.2.1

Closed 4 months ago 1 comment

Package Details

Name:	`activestorage`
Ecosystem:	rubygems
PURL Type:	gem
Package URL:	`pkg:gem/activestorage`
JSON API:	View JSON

Security Advisories

10

Active advisories

CRITICAL 2

HIGH 2

MODERATE 5

LOW 1

View All gem Advisories

Package Information

Description:

Attach cloud and local files in Rails applications.

Repository:	https://github.com/rails/rails
Homepage:	https://rubyonrails.org
Latest Release:	`8.0.2` over 1 year ago
Dependent Repos:	289,858
Dependent Packages:	65
Downloads:	386,801,111
Ranking:	Top 0.0847% by dependent repos Top 0.0624% by downloads Top 0.4488% by dependent pkgs

PR Status

Open 561 (57.0%)

Merged 155 (15.7%)

Closed 268 (27.2%)

PR Types

Major 11 (1.1%)

Minor 18 (1.8%)

Patch 161 (16.3%)

activestorage

Security Advisories

Rails Active Storage has a possible DoS vulnerability when in proxy mode via Range requests

Possible code injection vulnerability in Rails / Active Storage

Exposure of Sensitive Information to an Unauthorized Actor in activestorage

Rails Active Storage has possible glob injection in its DiskService

Rails Active Storage has possible content type bypass via metadata in direct uploads

Recent PRs

Package Details

Security Advisories

10

Package Information

PR Status

PR Types

`activestorage`