CVE-2023-51763: ActiveAdmin CSV Injection leading to sensitive information disclosure
Summary
CVE-2023-51763: ActiveAdmin CSV Injection leading to sensitive information disclosure. Affects activeadmin versions < 3.2.0. Fixed in 3.2.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ActiveAdmin is a RubyGem that provides a framework for creating administration-style interfaces for web applications. It simplifies the process of building administrative interfaces by providing a set of pre-built components and tools. ActiveAdmin allows developers to quickly generate admin interfaces for managing data in their applications. However, versions prior to 3.2.0 are vulnerable to CSV Injection, which can lead to sensitive information disclosure.
Vulnerability Detail
The vulnerability in ActiveAdmin versions prior to 3.2.0 arises from the ability to upload maliciously crafted spreadsheet formulas as part of admin data. When this data is exported to a CSV file and imported into a spreadsheet program like LibreOffice, it can trigger remote code execution and private data exfiltration. The attacker requires privileges to upload data to the same ActiveAdmin application as the victim and relies on the victim potentially ignoring security warnings from their spreadsheet program. The vulnerability is rated as MODERATE with a CVSS score of 5.2.
How To Fix
Latest published version: 3.5.2 as of 23 Oct 2026
gem install activeadmin -v 3.5.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.2.0
This is the first release that contains the fix.
gem install activeadmin -v 3.2.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
To mitigate the risk, users can turn off formula evaluation in spreadsheet programs when importing CSV files unless they have explicitly reviewed the file for any potential issues.
Conclusion
ActiveAdmin versions prior to 3.2.0 are vulnerable to CSV Injection, which can lead to remote code execution and sensitive information disclosure. It is recommended to update to version 3.2.0 or above to fix the vulnerability. Alternatively, users can mitigate the risk by disabling formula evaluation in spreadsheet programs when importing CSV files unless they have explicitly reviewed the file. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for activeadmin →
FAQ
ActiveAdmin is a RubyGem that simplifies the process of building administration-style interfaces for web applications.
CSV Injection is a technique where maliciously crafted spreadsheet formulas are injected into CSV files, which can lead to remote code execution and data exfiltration when imported into spreadsheet programs.
The vulnerability allows an attacker to execute remote code and exfiltrate private data if the victim imports a malicious CSV file into a spreadsheet program.
Update ActiveAdmin to version 3.2.0 or above, which includes the fix for this vulnerability.
You can mitigate the risk by disabling formula evaluation in spreadsheet programs when importing CSV files unless you have explicitly reviewed the file.
References
Related vulnerabilities
Recent vulnerabilities recorded for activeadmin.
