Rails fixed three of four methods in 2020. The fourth took six years
2026-11-05Security
A High-severity Strong Parameters bypass in Action Pack is an incomplete fix of a 2020 advisory. That advisory corrected three iteration methods and left the fourth delegating to the raw hash.