Packages / Debian 13 (Trixie) / ruby / rails

Package: rails (2:7.2.2.2+dfsg-2~deb13u1)

MVC ruby based framework geared for web application development (metapackage)

Other Packages Related to rails:

dep: [ruby-rails] (= 2:7.2.2.2+dfsg-2~deb13u1)
MVC ruby based framework geared for web application development
dep: [bundler]
Manage Ruby application dependencies
dep: [puma] (>= 6.0~)
threaded HTTP 1.1 server for Ruby/Rack applications
dep: [ruby-bootsnap] (>= 1.4.2~)
Boot large ruby/rails apps faster
dep: [ruby-byebug]
Ruby fast debugger - base + CLI
dep: [ruby-capybara] (>= 2.15)
integration testing tool for Rack based web applications
dep: [ruby-jbuilder]
creation of JSON structures via a Builder-style DSL
dep: [ruby-listen] (>= 3.2~)
Ruby library listening to file modifications
dep: [ruby-selenium-webdriver] (>= 4.0.0)
Browser automation framework and ecosystem
dep: [ruby-spring]
Rails application preloader
dep: [ruby-spring-watcher-listen]
Makes spring watch files using the listen library
dep: [ruby-sqlite3]
SQLite3 interface for Ruby
dep: [ruby-turbolinks] (>= 5.0)
following links in your Rails web application faster
dep: [ruby-web-console] (>= 4.1~)
Ruby on Rails debugger

rec: [yarnpkg]
Fast, reliable, and secure dependency management

Download rails

Architecture	Package size	Installed size	Files	Package
all	20 KiB	51 KiB	list of files	Download

Package file paths (0)

Paths come from the repository package-file index for the observed builds. They describe archive/package associations, not every file that will exist on a running system after maintainer scripts, alternatives, generated state, diversions, or installation choices.

No package-associated file paths were observed for the displayed build metadata.

Field source: Debian 13 (Trixie) main amd64

Use this package

OpenFactory can boot this operating system in a browser VM, or start a build that includes the native package name from this record.

Try Debian 13 (Trixie) in the browser Build an image that includes rails

Versions, suites, and repositories

Each row is recorded package-index metadata for one version, architecture, suite, and repository. Names, URLs, and sizes are source-reported; a link is a potentially mutable retrieval location, not an OpenFactory redistribution claim or proof that OpenFactory retained the artifact bytes.

Version	Release	Architecture	Repository	Package size	Installed size	Publisher repository artifact
2:7.2.2.2+dfsg-2~deb13u1	trixie / main	all	Debian 13 · main · amd64	19 KiB	50 KiB	pool/main/r/rails/rails_7.2.2.2+dfsg-2~deb13u1_all.deb
2:7.2.2.2+dfsg-2~deb13u1	trixie / main	all	Debian 13 · main · arm64	19 KiB	50 KiB	pool/main/r/rails/rails_7.2.2.2+dfsg-2~deb13u1_all.deb
2:7.2.2.2+dfsg-2~deb13u2	trixie-security / main	all	Debian 13 security · main · amd64	20 KiB	51 KiB	pool/updates/main/r/rails/rails_7.2.2.2+dfsg-2~deb13u2_all.deb
2:7.2.2.2+dfsg-2~deb13u1	trixie-security / main	all	Debian 13 security · main · arm64	19 KiB	50 KiB	pool/updates/main/r/rails/rails_7.2.2.2+dfsg-2~deb13u1_all.deb
2:7.2.2.2+dfsg-2~deb13u1 (withdrawn)	trixie-security / main	all	Debian 13 security · main · amd64	19 KiB	50 KiB	pool/updates/main/r/rails/rails_7.2.2.2+dfsg-2~deb13u1_all.deb

Field source: Debian 13 (Trixie) main amd64

Known vulnerabilities

Matching against OpenFactory catalog package versions is in progress.

CVE	Severity	Version impact
[CVE-2026-66066] Action Pack is a framework for handling and responding to web requests. In versions prior to 7.2.3.2, 8.0.5.1 and 8.1.3.1, Active Storage does not disable libvips operations marked unsafe for untruste	Critical(9.5)	Affected Details (5) `2:7.2.2.2+dfsg-2~deb13u1` · all · trixie Affected · Fixed: `2:7.2.2.2+dfsg-2~deb13u2` nvd · rails · debian · 13 `2:7.2.2.2+dfsg-2~deb13u1` · all · trixie Affected · Fixed: `2:7.2.2.2+dfsg-2~deb13u2` nvd · rails · debian · 13 `2:7.2.2.2+dfsg-2~deb13u1` · all · trixie-security · Historical version Affected · Fixed: `2:7.2.2.2+dfsg-2~deb13u2` nvd · rails · debian · 13 `2:7.2.2.2+dfsg-2~deb13u1` · all · trixie-security Affected · Fixed: `2:7.2.2.2+dfsg-2~deb13u2` nvd · rails · debian · 13 `2:7.2.2.2+dfsg-2~deb13u2` · all · trixie-security Fixed · Fixed: `2:7.2.2.2+dfsg-2~deb13u2` nvd · rails · debian · 13
[CVE-2026-33168] Action View provides conventions and helpers for building web pages with the Rails framework. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, when a blank string is used as an HTML attribute name in	Low(2.3)	Affected Details (5) `2:7.2.2.2+dfsg-2~deb13u1` · all · trixie Affected · Fixed: `2:7.2.2.2+dfsg-2~deb13u2` nvd · rails · debian · 13 `2:7.2.2.2+dfsg-2~deb13u1` · all · trixie Affected · Fixed: `2:7.2.2.2+dfsg-2~deb13u2` nvd · rails · debian · 13 `2:7.2.2.2+dfsg-2~deb13u1` · all · trixie-security · Historical version Affected · Fixed: `2:7.2.2.2+dfsg-2~deb13u2` nvd · rails · debian · 13 `2:7.2.2.2+dfsg-2~deb13u1` · all · trixie-security Affected · Fixed: `2:7.2.2.2+dfsg-2~deb13u2` nvd · rails · debian · 13 `2:7.2.2.2+dfsg-2~deb13u2` · all · trixie-security Fixed · Fixed: `2:7.2.2.2+dfsg-2~deb13u2` nvd · rails · debian · 13
[CVE-2026-33169] Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. `NumberToDelimitedConverter` uses a lookahead-based regular expression with `gsub!` to ins	Medium(6.9)	Affected Details (5) `2:7.2.2.2+dfsg-2~deb13u1` · all · trixie Affected · Fixed: `2:7.2.2.2+dfsg-2~deb13u2` nvd · rails · debian · 13 `2:7.2.2.2+dfsg-2~deb13u1` · all · trixie Affected · Fixed: `2:7.2.2.2+dfsg-2~deb13u2` nvd · rails · debian · 13 `2:7.2.2.2+dfsg-2~deb13u1` · all · trixie-security · Historical version Affected · Fixed: `2:7.2.2.2+dfsg-2~deb13u2` nvd · rails · debian · 13 `2:7.2.2.2+dfsg-2~deb13u1` · all · trixie-security Affected · Fixed: `2:7.2.2.2+dfsg-2~deb13u2` nvd · rails · debian · 13 `2:7.2.2.2+dfsg-2~deb13u2` · all · trixie-security Fixed · Fixed: `2:7.2.2.2+dfsg-2~deb13u2` nvd · rails · debian · 13
[CVE-2026-33170] Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, `SafeBuffer#%` does not propagate the `@h	Medium(5.3)	Affected Details (5) `2:7.2.2.2+dfsg-2~deb13u1` · all · trixie Affected · Fixed: `2:7.2.2.2+dfsg-2~deb13u2` nvd · rails · debian · 13 `2:7.2.2.2+dfsg-2~deb13u1` · all · trixie Affected · Fixed: `2:7.2.2.2+dfsg-2~deb13u2` nvd · rails · debian · 13 `2:7.2.2.2+dfsg-2~deb13u1` · all · trixie-security · Historical version Affected · Fixed: `2:7.2.2.2+dfsg-2~deb13u2` nvd · rails · debian · 13 `2:7.2.2.2+dfsg-2~deb13u1` · all · trixie-security Affected · Fixed: `2:7.2.2.2+dfsg-2~deb13u2` nvd · rails · debian · 13 `2:7.2.2.2+dfsg-2~deb13u2` · all · trixie-security Fixed · Fixed: `2:7.2.2.2+dfsg-2~deb13u2` nvd · rails · debian · 13
[CVE-2026-33173] Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, `DirectUploadsController` accepts arbitrary metadata from the client	Medium(5.3)	Affected Details (5) `2:7.2.2.2+dfsg-2~deb13u1` · all · trixie Affected · Fixed: `2:7.2.2.2+dfsg-2~deb13u2` nvd · rails · debian · 13 `2:7.2.2.2+dfsg-2~deb13u1` · all · trixie Affected · Fixed: `2:7.2.2.2+dfsg-2~deb13u2` nvd · rails · debian · 13 `2:7.2.2.2+dfsg-2~deb13u1` · all · trixie-security Affected · Fixed: `2:7.2.2.2+dfsg-2~deb13u2` nvd · rails · debian · 13 `2:7.2.2.2+dfsg-2~deb13u1` · all · trixie-security · Historical version Affected · Fixed: `2:7.2.2.2+dfsg-2~deb13u2` nvd · rails · debian · 13 `2:7.2.2.2+dfsg-2~deb13u2` · all · trixie-security Fixed · Fixed: `2:7.2.2.2+dfsg-2~deb13u2` nvd · rails · debian · 13
[CVE-2026-33174] Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, when serving files through Active Storage's proxy delivery mode, the	Medium(6.6)	Affected Details (5) `2:7.2.2.2+dfsg-2~deb13u1` · all · trixie Affected · Fixed: `2:7.2.2.2+dfsg-2~deb13u2` nvd · rails · debian · 13 `2:7.2.2.2+dfsg-2~deb13u1` · all · trixie Affected · Fixed: `2:7.2.2.2+dfsg-2~deb13u2` nvd · rails · debian · 13 `2:7.2.2.2+dfsg-2~deb13u1` · all · trixie-security · Historical version Affected · Fixed: `2:7.2.2.2+dfsg-2~deb13u2` nvd · rails · debian · 13 `2:7.2.2.2+dfsg-2~deb13u1` · all · trixie-security Affected · Fixed: `2:7.2.2.2+dfsg-2~deb13u2` nvd · rails · debian · 13 `2:7.2.2.2+dfsg-2~deb13u2` · all · trixie-security Fixed · Fixed: `2:7.2.2.2+dfsg-2~deb13u2` nvd · rails · debian · 13
[CVE-2026-33176] Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Support number helpers accept stri	Medium(6.6)	Affected Details (5) `2:7.2.2.2+dfsg-2~deb13u1` · all · trixie Affected · Fixed: `2:7.2.2.2+dfsg-2~deb13u2` nvd · rails · debian · 13 `2:7.2.2.2+dfsg-2~deb13u1` · all · trixie Affected · Fixed: `2:7.2.2.2+dfsg-2~deb13u2` nvd · rails · debian · 13 `2:7.2.2.2+dfsg-2~deb13u1` · all · trixie-security Affected · Fixed: `2:7.2.2.2+dfsg-2~deb13u2` nvd · rails · debian · 13 `2:7.2.2.2+dfsg-2~deb13u1` · all · trixie-security · Historical version Affected · Fixed: `2:7.2.2.2+dfsg-2~deb13u2` nvd · rails · debian · 13 `2:7.2.2.2+dfsg-2~deb13u2` · all · trixie-security Fixed · Fixed: `2:7.2.2.2+dfsg-2~deb13u2` nvd · rails · debian · 13
[CVE-2026-33195] Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Storage's `DiskService#path_for` does not validate that the r	High(8)	Affected Details (5) `2:7.2.2.2+dfsg-2~deb13u1` · all · trixie Affected · Fixed: `2:7.2.2.2+dfsg-2~deb13u2` nvd · rails · debian · 13 `2:7.2.2.2+dfsg-2~deb13u1` · all · trixie Affected · Fixed: `2:7.2.2.2+dfsg-2~deb13u2` nvd · rails · debian · 13 `2:7.2.2.2+dfsg-2~deb13u1` · all · trixie-security Affected · Fixed: `2:7.2.2.2+dfsg-2~deb13u2` nvd · rails · debian · 13 `2:7.2.2.2+dfsg-2~deb13u1` · all · trixie-security · Historical version Affected · Fixed: `2:7.2.2.2+dfsg-2~deb13u2` nvd · rails · debian · 13 `2:7.2.2.2+dfsg-2~deb13u2` · all · trixie-security Fixed · Fixed: `2:7.2.2.2+dfsg-2~deb13u2` nvd · rails · debian · 13
[CVE-2026-33202] Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Storage's `DiskService#delete_prefixed` passes blob keys dire	Medium(6.6)	Affected Details (5) `2:7.2.2.2+dfsg-2~deb13u1` · all · trixie Affected · Fixed: `2:7.2.2.2+dfsg-2~deb13u2` nvd · rails · debian · 13 `2:7.2.2.2+dfsg-2~deb13u1` · all · trixie Affected · Fixed: `2:7.2.2.2+dfsg-2~deb13u2` nvd · rails · debian · 13 `2:7.2.2.2+dfsg-2~deb13u1` · all · trixie-security · Historical version Affected · Fixed: `2:7.2.2.2+dfsg-2~deb13u2` nvd · rails · debian · 13 `2:7.2.2.2+dfsg-2~deb13u1` · all · trixie-security Affected · Fixed: `2:7.2.2.2+dfsg-2~deb13u2` nvd · rails · debian · 13 `2:7.2.2.2+dfsg-2~deb13u2` · all · trixie-security Fixed · Fixed: `2:7.2.2.2+dfsg-2~deb13u2` nvd · rails · debian · 13
[CVE-2026-33658] Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 Active Storage's proxy controller does not limit the number of byte r	Low(2.3)	Affected Details (5) `2:7.2.2.2+dfsg-2~deb13u1` · all · trixie Affected · Fixed: `2:7.2.2.2+dfsg-2~deb13u2` nvd · rails · debian · 13 `2:7.2.2.2+dfsg-2~deb13u1` · all · trixie Affected · Fixed: `2:7.2.2.2+dfsg-2~deb13u2` nvd · rails · debian · 13 `2:7.2.2.2+dfsg-2~deb13u1` · all · trixie-security · Historical version Affected · Fixed: `2:7.2.2.2+dfsg-2~deb13u2` nvd · rails · debian · 13 `2:7.2.2.2+dfsg-2~deb13u1` · all · trixie-security Affected · Fixed: `2:7.2.2.2+dfsg-2~deb13u2` nvd · rails · debian · 13 `2:7.2.2.2+dfsg-2~deb13u2` · all · trixie-security Fixed · Fixed: `2:7.2.2.2+dfsg-2~deb13u2` nvd · rails · debian · 13
[CVE-2010-3299] rails: CVE-2010-3299	Low	Affected Details (5) `2:7.2.2.2+dfsg-2~deb13u1` · all · trixie Affected dsa · rails · debian · 13 `2:7.2.2.2+dfsg-2~deb13u1` · all · trixie Affected dsa · rails · debian · 13 `2:7.2.2.2+dfsg-2~deb13u1` · all · trixie-security · Historical version Affected dsa · rails · debian · 13 `2:7.2.2.2+dfsg-2~deb13u1` · all · trixie-security Affected dsa · rails · debian · 13 `2:7.2.2.2+dfsg-2~deb13u2` · all · trixie-security Affected dsa · rails · debian · 13
[CVE-2017-17920] rails: CVE-2017-17920	Low	Affected Details (5) `2:7.2.2.2+dfsg-2~deb13u1` · all · trixie Affected dsa · rails · debian · 13 `2:7.2.2.2+dfsg-2~deb13u1` · all · trixie Affected dsa · rails · debian · 13 `2:7.2.2.2+dfsg-2~deb13u1` · all · trixie-security Affected dsa · rails · debian · 13 `2:7.2.2.2+dfsg-2~deb13u1` · all · trixie-security · Historical version Affected dsa · rails · debian · 13 `2:7.2.2.2+dfsg-2~deb13u2` · all · trixie-security Affected dsa · rails · debian · 13
[CVE-2017-17919] rails: CVE-2017-17919	Low	Affected Details (5) `2:7.2.2.2+dfsg-2~deb13u1` · all · trixie Affected dsa · rails · debian · 13 `2:7.2.2.2+dfsg-2~deb13u1` · all · trixie Affected dsa · rails · debian · 13 `2:7.2.2.2+dfsg-2~deb13u1` · all · trixie-security · Historical version Affected dsa · rails · debian · 13 `2:7.2.2.2+dfsg-2~deb13u1` · all · trixie-security Affected dsa · rails · debian · 13 `2:7.2.2.2+dfsg-2~deb13u2` · all · trixie-security Affected dsa · rails · debian · 13
[CVE-2017-17917] rails: CVE-2017-17917	Low	Affected Details (5) `2:7.2.2.2+dfsg-2~deb13u1` · all · trixie Affected dsa · rails · debian · 13 `2:7.2.2.2+dfsg-2~deb13u1` · all · trixie Affected dsa · rails · debian · 13 `2:7.2.2.2+dfsg-2~deb13u1` · all · trixie-security · Historical version Affected dsa · rails · debian · 13 `2:7.2.2.2+dfsg-2~deb13u1` · all · trixie-security Affected dsa · rails · debian · 13 `2:7.2.2.2+dfsg-2~deb13u2` · all · trixie-security Affected dsa · rails · debian · 13
[CVE-2017-17916] rails: CVE-2017-17916	Low	Affected Details (5) `2:7.2.2.2+dfsg-2~deb13u1` · all · trixie Affected dsa · rails · debian · 13 `2:7.2.2.2+dfsg-2~deb13u1` · all · trixie Affected dsa · rails · debian · 13 `2:7.2.2.2+dfsg-2~deb13u1` · all · trixie-security · Historical version Affected dsa · rails · debian · 13 `2:7.2.2.2+dfsg-2~deb13u1` · all · trixie-security Affected dsa · rails · debian · 13 `2:7.2.2.2+dfsg-2~deb13u2` · all · trixie-security Affected dsa · rails · debian · 13
[CVE-2011-3187] rails: CVE-2011-3187	Low	Affected Details (5) `2:7.2.2.2+dfsg-2~deb13u1` · all · trixie Affected dsa · rails · debian · 13 `2:7.2.2.2+dfsg-2~deb13u1` · all · trixie Affected dsa · rails · debian · 13 `2:7.2.2.2+dfsg-2~deb13u1` · all · trixie-security · Historical version Affected dsa · rails · debian · 13 `2:7.2.2.2+dfsg-2~deb13u1` · all · trixie-security Affected dsa · rails · debian · 13 `2:7.2.2.2+dfsg-2~deb13u2` · all · trixie-security Affected dsa · rails · debian · 13

Fixed and unaffected versions (4)

CVE	Severity	Version impact
[CVE-2021-44528] rails: CVE-2021-44528	Medium	Fixed Details (5) `2:7.2.2.2+dfsg-2~deb13u1` · all · trixie Fixed · Fixed: `2:6.1.4.6+dfsg-1` dsa · rails · debian · 13 `2:7.2.2.2+dfsg-2~deb13u1` · all · trixie Fixed · Fixed: `2:6.1.4.6+dfsg-1` dsa · rails · debian · 13 `2:7.2.2.2+dfsg-2~deb13u1` · all · trixie-security Fixed · Fixed: `2:6.1.4.6+dfsg-1` dsa · rails · debian · 13 `2:7.2.2.2+dfsg-2~deb13u1` · all · trixie-security · Historical version Fixed · Fixed: `2:6.1.4.6+dfsg-1` dsa · rails · debian · 13 `2:7.2.2.2+dfsg-2~deb13u2` · all · trixie-security Fixed · Fixed: `2:6.1.4.6+dfsg-1` dsa · rails · debian · 13
[CVE-2021-22942] rails: CVE-2021-22942	Medium	Fixed Details (5) `2:7.2.2.2+dfsg-2~deb13u1` · all · trixie Fixed · Fixed: `2:6.1.4.1+dfsg-3` dsa · rails · debian · 13 `2:7.2.2.2+dfsg-2~deb13u1` · all · trixie Fixed · Fixed: `2:6.1.4.1+dfsg-3` dsa · rails · debian · 13 `2:7.2.2.2+dfsg-2~deb13u1` · all · trixie-security Fixed · Fixed: `2:6.1.4.1+dfsg-3` dsa · rails · debian · 13 `2:7.2.2.2+dfsg-2~deb13u1` · all · trixie-security · Historical version Fixed · Fixed: `2:6.1.4.1+dfsg-3` dsa · rails · debian · 13 `2:7.2.2.2+dfsg-2~deb13u2` · all · trixie-security Fixed · Fixed: `2:6.1.4.1+dfsg-3` dsa · rails · debian · 13
[CVE-2021-22885] rails: CVE-2021-22885	High(7.5)	Fixed Details (5) `2:7.2.2.2+dfsg-2~deb13u1` · all · trixie Fixed · Fixed: `2:6.0.3.7+dfsg-1` dsa · rails · debian · 13 `2:7.2.2.2+dfsg-2~deb13u1` · all · trixie Fixed · Fixed: `2:6.0.3.7+dfsg-1` dsa · rails · debian · 13 `2:7.2.2.2+dfsg-2~deb13u1` · all · trixie-security · Historical version Fixed · Fixed: `2:6.0.3.7+dfsg-1` dsa · rails · debian · 13 `2:7.2.2.2+dfsg-2~deb13u1` · all · trixie-security Fixed · Fixed: `2:6.0.3.7+dfsg-1` dsa · rails · debian · 13 `2:7.2.2.2+dfsg-2~deb13u2` · all · trixie-security Fixed · Fixed: `2:6.0.3.7+dfsg-1` dsa · rails · debian · 13
[CVE-2021-22902] rails: CVE-2021-22902	High(7.5)	Fixed Details (5) `2:7.2.2.2+dfsg-2~deb13u1` · all · trixie Fixed · Fixed: `2:6.0.3.7+dfsg-1` dsa · rails · debian · 13 `2:7.2.2.2+dfsg-2~deb13u1` · all · trixie Fixed · Fixed: `2:6.0.3.7+dfsg-1` dsa · rails · debian · 13 `2:7.2.2.2+dfsg-2~deb13u1` · all · trixie-security Fixed · Fixed: `2:6.0.3.7+dfsg-1` dsa · rails · debian · 13 `2:7.2.2.2+dfsg-2~deb13u1` · all · trixie-security · Historical version Fixed · Fixed: `2:6.0.3.7+dfsg-1` dsa · rails · debian · 13 `2:7.2.2.2+dfsg-2~deb13u2` · all · trixie-security Fixed · Fixed: `2:6.0.3.7+dfsg-1` dsa · rails · debian · 13

[Next results]

Last synced: Oct 23, 2026, 11:28:26 PM UTC

[CVE catalog]

Checksums

Repository signatures authenticate metadata. Artifact hashing is recorded separately. Neither establishes package safety.

2:7.2.2.2+dfsg-2~deb13u1 / allObserved Sep 1, 2026sha256 62e0ee866501…e73de71dSource-reported digest