SQL Injection Flaw Found in Trilogy Gem
CERT-FR warns of a SQL injection vulnerability in the trilogy Ruby MySQL client library, affecting versions before 2.13.2.
Sourcecert.cyber.gouv.fr — open the original
What to check
- Applies to
- Not tied to a specific actor, malware or CVE, only to the sectors it covers, so it may be general reporting. Check the source before acting on it. Whether it concerns you is not assessed.
CERT-FR has published an advisory regarding a SQL injection vulnerability discovered in trilogy, a Ruby library used as a MySQL client, notably by Ruby on Rails applications. The flaw stems from improper escaping behavior when handling multibyte character encodings, which can allow an attacker to craft inputs that break out of expected SQL string boundaries and inject malicious SQL commands.
The vulnerability affects all versions of trilogy prior to 2.13.2. No evidence of active exploitation in the wild is mentioned in the advisory. Organizations using Ruby on Rails applications with the trilogy gem as a MySQL adapter should treat this as a routine but important patching action, given the potential impact of SQL injection on data confidentiality and integrity.
CERT-FR directs administrators to the official Ruby on Rails security bulletin and the GitHub security advisory (GHSA-744p-w4gc-m3gh) for patch details. Defenders should update the trilogy library to version 2.13.2 or later and review application logs for anomalous database query patterns, particularly those involving multibyte encoded input, as a precautionary detection measure.
Source reporting: https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1424
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs