Active Job - Object injection security vulnerability

MEDIUMGHSA-mpwp-4h2m-765c · Published 16/01/2026 · updated 03/02/2026

In short

GHSA-mpwp-4h2m-765c is a MEDIUM vulnerability affecting activejob.
Fix: update to 4.2.0.beta2 or later.

Package	Affected versions	Patched versions
activejob RubyGems	`< 4.2.0.beta2`	`4.2.0.beta2`

Description

Active Job vulnerability: An Active Job bug allowed String arguments to be deserialized as if they were Global IDs, an object injection security vulnerability.

References

advisories.gitlab.com/pkg/gem/activejob/OSVDB-112347 · WEB
rails/rails · PACKAGE
rubysec/ruby-advisory-db · WEB
rubysec/ruby-advisory-db · WEB

More vulnerabilities in activejob

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free