If you upgraded to Rails 8.0.5.2 or 8.1.4.1 after my post on the 21 security fixes and your app runs on MySQL through Trilogy, there's one more gem to update. Six days before the Rails release, Trilogy published a critical SQL injection advisory, GHSA-744p-w4gc-m3gh (a GitHub Security Advisory ID). It isn't part of the Rails batch, and upgrading Rails doesn't pull in the fix.

Trilogy is the MySQL client gem behind Rails' trilogy database adapter, the alternative to mysql2. The advisory has no CVE ID (the usual public vulnerability number) yet.

What Went Wrong

Trilogy#escape makes a string safe to put in a SQL query by escaping characters like quotes. It was written for encodings where a byte that looks like a quote is always a quote. Shift_JIS and Windows-31J (Japanese) and Big5, GBK, and GB18030 (Chinese) don't work that way: the second byte of a two-byte character can be the same byte as a quote or backslash. Trilogy and MySQL can then disagree about where a character ends, and an attacker can use that to get a quote through unescaped. That's SQL injection.

The advisory lists two ways an app is affected:

  1. On any connection character set, including the default utf8mb4 (MySQL's full UTF-8), if an attacker can influence the encoding of a string the app escapes.

  2. On a connection configured with encoding: sjis, cp932, big5, gbk, or gb18030.

It describes the impact as SQL injection that doesn't require logging in and says Rails apps using the Trilogy adapter are likely affected. With the Trilogy adapter in Rails 8.1.4.1, Active Record's quote_string calls Trilogy#escape, so string values Active Record quotes into your queries go through it.

Why the Rails Upgrade Didn't Fix It

The Trilogy adapter in both 8.0.5.2 and 8.1.4.1 still asks only for gem "trilogy", "~> 2.7", and neither security release touches the MySQL or Trilogy code. If you followed the bundle update rails --conservative step from the last post, Trilogy stayed on whatever version you had.

Dependabot won't open a pull request for it yet either. As of November 6, the advisory isn't in GitHub's reviewed advisory database, which is where Dependabot alerts come from.

What to Do

  1. Check your version: 
bundle info trilogy
  1. If it's 2.13.1 or older, update it: 
bundle update trilogy --conservative

The advisory names 2.13.2 as the fix. 2.13.3 came out on November 4 with a commit titled "Further harden encoding_for_charset," so I'd take the latest.

If your Gemfile sets a Bundler cooldown, both fixed versions are still inside a 14-day window, and the update stops with a cooldown error. Override it for this one run with bundle update trilogy --conservative --cooldown 0.

  1. If your database.yml sets one of the five encodings above, those connection encodings now raise ArgumentError. The advisory says they never worked correctly and are no longer supported. Moving to utf8mb4 is the usual path, and if your tables hold data in those encodings, that's a data migration to plan before you deploy the gem update.

If You Can't Upgrade Yet

The advisory's workaround is to enforce the encoding of every string passed to Trilogy#escape and Trilogy#query. Every string value Active Record quotes goes through escape, so that means far more than your own hand-written queries. Updating the gem is the more reliable fix.

More Information