CERT-FR Advisory: SQL Injection Vulnerability in Ruby on Rails trilogy Library
The French CERT-FR published advisory CERTFR-2026-AVI-1424 regarding a vulnerability in trilogy, a Ruby on Rails MySQL adapter library. The flaw affects versions prior to 2.13.2 and allows an attacker to trigger a SQL injection (SQLi) through multibyte encoding escape handling. No active exploitation is mentioned in the advisory.
Entenda a falha
A vulnerabilidade
A SQL injection flaw in trilogy, the MySQL client library used as an adapter for Ruby on Rails. It lies in the library's escape handling when multibyte character encodings are used. All versions before 2.13.2 are affected and 2.13.2 fixes it. No CVE is listed. The articles do not say what access or configuration an attacker needs, nor the exact impact, beyond injecting SQL. CERT-FR mentions no active exploitation.
Como funciona
An application passes data to trilogy's escape function so it can be placed safely inside a SQL string. According to the advisory title, the escaping goes wrong when the connection uses a multibyte encoding. The escaped value can then still alter the structure of the query, so the database runs SQL the developer did not intend. The articles give no finer detail on the exact step.
Por que é vulnerável
The advisory title attributes the problem to the escape function not handling multibyte encodings correctly, so escaping does not neutralize input as expected. The articles do not describe the root cause further, nor why it went unnoticed. The fix is in trilogy 2.13.2; the articles do not detail what it changes.
Onde está
The articles name the escape handling in trilogy (the escape function, per the advisory title) and point to GHSA-744p-w4gc-m3gh in the trilogy-libraries/trilogy repository; no file or commit is named.
Como foi descoberta
The articles do not say who found the flaw or how. The maintainers published GHSA-744p-w4gc-m3gh on GitHub and Ruby on Rails security bulletin 91797 on 29 October 2026, and CERT-FR issued advisory CERTFR-2026-AVI-1424 the next day. CERT-FR mentions no exploitation in the wild.
Explicação gerada por IA a partir da matéria e dos artigos, em 03/11/2026 12:19.
Detalhes técnicos
- Vulnerability type: SQL injection via escape handling with multibyte encodings.
- Affected product: trilogy versions prior to 2.13.2.
- References: GHSA-744p-w4gc-m3gh and Ruby on Rails security bulletin 91797, both published 29 October 2026.
Remediação
- Update trilogy to version 2.13.2 or later.
- Refer to the official GitHub security advisory and Ruby on Rails bulletin for patch details.
Linha do tempo
-
CERT-FR Advisory: SQL Injection Vulnerability in Ruby on Rails trilogy Library
ler a análise desta fonte ocultar
The French CERT-FR published advisory CERTFR-2026-AVI-1424 regarding a vulnerability in trilogy, a Ruby on Rails MySQL adapter library. The flaw affects versions prior to 2.13.2 and allows an attacker to trigger a SQL injection (SQLi) through multibyte encoding escape handling. No active exploitation is mentioned in the advisory.
Technical Details
- Vulnerability type: SQL injection via escape handling with multibyte encodings.
- Affected product: trilogy versions prior to 2.13.2.
- References: GHSA-744p-w4gc-m3gh and Ruby on Rails security bulletin 91797, both published 29 October 2026.
Remediation
- Update trilogy to version 2.13.2 or later.
- Refer to the official GitHub security advisory and Ruby on Rails bulletin for patch details.