If you upgraded to Rails 8.0.5.2 or 8.1.4.1 after my post on the 21 security fixes and your app runs on MySQL through Trilogy, there's one more gem to update. Six days before the Rails release, Trilogy published a critical SQL injection advisory, GHSA-744p-w4gc-m3gh (a GitHub Security Advisory ID). It isn't part of the Rails batch, and upgrading Rails doesn't pull in the fix.

Trilogy is the MySQL client gem behind Rails' trilogy database adapter, the alternative to mysql2 . The advisory has no CVE ID (the usual public vulnerability number) yet.

What Went Wrong

Trilogy#escape makes a string safe to put in a SQL query by escaping characters like quotes. It was written for encodings where a byte that looks like a quote is always a quote. Shift_JIS and Windows-31J (Japanese) and Big5, GBK, and GB18030 (Chinese) don't work that way: the second byte of a two-byte character can be the same byte as a quote or backslash.…