Rails released two security updates, 8.1.4.1 and 8.0.5.2, addressing 21 vulnerabilities, including a Critical flaw in Active Storage that could allow remote code execution. The patches cover a range of issues, mostly categorized as Medium and Low severity, with notable vulnerabilities in Action View and Strong Parameters. Importantly, support for the 8.0 version will end on November 7, 2026, which may make 8.0.5.2 the final security update for that series. Users are advised to migrate to version 8.1.4.1 for continued security support and to address the vulnerabilities effectively

Rails 8.1.4.1 and 8.0.5.2 Security Release: 21 CVEs Packed, 8.0 EOL in Days

Rails shipped two coordinated security releases this week, 8.1.4.1 and 8.0.5.2, patching 21 issues across nearly every subsystem in a single batch. A Critical 9.8 flaw in Active Storage dominates the list, letting attackers read and write arbitrary files through ImageMagick and potentially reach remote code execution. Most of the remaining issues sit in the Medium and Low range, including an XSS cluster in Action View's text helpers and a Strong Parameters bypass. The bigger story is the calendar: security support for Rails 8.0 ends on 7 November 2026, just three days after these releases, making 8.0.5.2 likely the final 8.0 security patch.

Rails 8.1.4.1 and 8.0.5.2 Security Release: 21 CVEs Packed, 8.0 EOL in Days @ Linux Compatible