[GHSA-744p-w4gc-m3gh] SQL injection through `Trilogy#escape` with multibyte encodings

Security Announcements
1

GHSA-744p-w4gc-m3gh

This is a vulnerability in the Trilogy library which is used by the Active Record Trilogy adapter. We believe it’s likely applications using Trilogy as their MySQL adapter are vulnerable and should upgrade immediately.

This has not yet been assigned a CVE identifier, I will update the report when it is.

Summary

Trilogy#escape produces unsafe output for Strings in Shift_JIS, Windows-31J, Big5, GBK or GB18030. In those encodings, the continuation byte of a multi byte character can be in the ASCII range. escape was intended for strict ASCII supersets and did not handle this correctly, which allowed SQL injection.

Details

Applications are affected in two cases:

  1. On any connection charset, including the default utf8mb4, when an attacker can influence the encoding of a String the application escapes.
  2. On connections configured with encoding: sjis, cp932, big5, gbk or gb18030. These connection encodings never worked correctly, are no longer supported, and now raise ArgumentError.

Impact

Unauthenticated SQL injection in applications that escape attacker-influenced Strings with Trilogy#escape. Ruby on Rails and other Rack applications using the Trilogy adapter are likely affected.

Workarounds

Applications unable to upgrade may be able to avoid this issue by enforcing the encoding of all strings passed to Trilogy#escape and Trilogy#query

Credit

Discovered by Anthropic’s OSS Scanner, as vulnerability ANT-2026-9KOHJMNW

1 Like