# SQL Injection Flaw Found in Trilogy Gem

Published: 2026-10-30 · Severity: routine · Sectors: Technology · Not tied to an actor or CVE
Canonical: https://vorant.io/reports/6a41903f-10b3-5bda-80ac-424e2c8d6c75/sql-injection-flaw-found-in-trilogy-gem
Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

> CERT-FR warns of a SQL injection vulnerability in the trilogy Ruby MySQL client library, affecting versions before 2.13.2.

Source: cert.cyber.gouv.fr — https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1424

## What to check

- Applies to: Not tied to a specific actor, malware or CVE, only to the sectors it covers, so it may be general reporting. Check the source before acting on it. Whether it concerns you is not assessed.

CERT-FR has published an advisory regarding a SQL injection vulnerability discovered in trilogy, a Ruby library used as a MySQL client, notably by Ruby on Rails applications. The flaw stems from improper escaping behavior when handling multibyte character encodings, which can allow an attacker to craft inputs that break out of expected SQL string boundaries and inject malicious SQL commands.

The vulnerability affects all versions of trilogy prior to 2.13.2. No evidence of active exploitation in the wild is mentioned in the advisory. Organizations using Ruby on Rails applications with the trilogy gem as a MySQL adapter should treat this as a routine but important patching action, given the potential impact of SQL injection on data confidentiality and integrity.

CERT-FR directs administrators to the official Ruby on Rails security bulletin and the GitHub security advisory (GHSA-744p-w4gc-m3gh) for patch details. Defenders should update the trilogy library to version 2.13.2 or later and review application logs for anomalous database query patterns, particularly those involving multibyte encoded input, as a precautionary detection measure.

Source reporting: https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1424

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/6a41903f-10b3-5bda-80ac-424e2c8d6c75/sql-injection-flaw-found-in-trilogy-gem.
The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup