Ce mail provient de l'extérieur, restons vigilants

=====================================================================


                            CERT-Renater

                Note d'Information No. 2026/VULN1112
_____________________________________________________________________

DATE                : 30/10/2026

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Trilogy library.

====================================================================
https://discuss.rubyonrails.org/t/ghsa-744p-w4gc-m3gh-sql-injection-through-trilogy-escape-with-multibyte-encodings/91797
_____________________________________________________________________


[GHSA-744p-w4gc-m3gh] SQL injection through `Trilogy#escape` with
multibyte encodings

Security Announcements
jhawthorn (John Hawthorn) October 29, 2026, 9:37pm 1

GHSA-744p-w4gc-m3gh

This is a vulnerability in the Trilogy library which is used by the 
Active Record Trilogy adapter. We believe it’s likely applications
using Trilogy as their MySQL adapter are vulnerable and should upgrade
immediately.

This has not yet been assigned a CVE identifier, I will update the
report when it is.


Summary

Trilogy#escape produces unsafe output for Strings in Shift_JIS,
Windows-31J, Big5, GBK or GB18030. In those encodings, the
continuation byte of a multi byte character can be in the ASCII
range. escape was intended for strict ASCII supersets and did not
handle this correctly, which allowed SQL injection.


Details

Applications are affected in two cases:

    On any connection charset, including the default utf8mb4, when
an attacker can influence the encoding of a String the application
escapes.

    On connections configured with encoding: sjis, cp932, big5, gbk
or gb18030. These connection encodings never worked correctly, are no
longer supported, and now raise ArgumentError.


Impact

Unauthenticated SQL injection in applications that escape
attacker-influenced Strings with Trilogy#escape. Ruby on Rails and
other Rack applications using the Trilogy adapter are likely
affected.


Workarounds

Applications unable to upgrade may be able to avoid this issue by
enforcing the encoding of all strings passed to Trilogy#escape
and Trilogy#query


Credit

Discovered by Anthropic’s OSS Scanner, as vulnerability ANT-2026-9KOHJMNW


=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================