GHSA-5QW5-WF2Q-F538

The Questionable Substitution: SQL Injection in JRuby's JDBC Adapter

Alon Barad
Alon Barad
Software Engineer

Jan 17, 2026·6 min read·4 visits

Executive Summary (TL;DR)

Older versions of the `activerecord-jdbc-adapter` (< 1.2.8) used a naive `gsub` strategy to replace SQL bind parameters (`?`). If a user input string contained a `?`, the adapter effectively hallucinated a new placeholder, injecting the *next* bind parameter directly into the current string literal. This breaks SQL syntax and allows for classic SQL injection attacks.

A recursive string substitution vulnerability in the activerecord-jdbc-adapter gem allowed attackers to inject malicious SQL by simply including a question mark in their input. This flaw affects JRuby applications connecting to databases via JDBC.

Technical Appendix

CVSS Score
8.8/ 10
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P
EPSS Probability
0.10%
Top 100% most exploited

Affected Systems

JRuby applications using ActiveRecordactiverecord-jdbc-adapter < 1.2.8

Affected Versions Detail

Product
Affected Versions
Fixed Version
activerecord-jdbc-adapter
RubyGems
< 1.2.81.2.8
AttributeDetail
Vulnerability TypeSQL Injection (Recursive Substitution)
CWE IDCWE-89
CVSS Score8.8 (High)
CVSS VectorCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P
Attack VectorNetwork
Affected Componentlib/arjdbc/jdbc/adapter.rb
CWE-89
SQL Injection

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Known Exploits & Detection

Vulnerability Timeline

Vulnerability reported in GitHub Issue #322
2013-02-05
Assigned OSVDB-114854
2013-02-25
Fix released in version 1.2.8
2013-02-28
GHSA Advisory published
2026-01-16

Subscribe to updates

Get the latest CVE analysis reports delivered to your inbox.