For the specific vulnerability that came out this week, you can just add the following to an initializer or application.rb: ActionDispatch::ParamsParser::DEFAU

For the specific vulnerability that came out this week, you can just add the following to an initializer or application.rb: ActionDispatch::ParamsParser::DEFAULT_PARSERS.delete(Mime::XML) This disable the XML parsing of params which introduced the bug and most people do not use. Like this you can at least be protected for now and give yourself time to test and review the upgrade to a newer version of Rails... It's still better to use the latest version and keep up to date, but right now the priority is to make sure that your application isn't vulnerable to an attack. To test if an application is vulnerable, you can use the following: curl -i -H "Content-Type: application/xml" -X POST -d '<id type="yaml">--- !ruby/object:ActionController::Base&#10;foo: 6</id>' http://example.com http://example.com If the logs show something like this then the application is vulnerable Parameters: {"id"=>#<ActionController::Base:0x007f8534fdd840 @foo=6>}