So looking at this CVE, it probably won't affect many apps. You have to be using number_to_currency (common), but also passing in user input to the parameters

So looking at this CVE, it probably won't affect many apps. You have to be using number_to_currency (common), but also passing in user input to the parameters format, negative_format or units which would not be a good idea anyway and is unlikely to have been done. I can't think why you would do that without verifying the unit and matching against a small set of acceptable currency units. You'd have to be doing this: <%= number_to_currency(number, format: unknown_user_text) %>