Doesn&#x27;t look <i>too</i> bad, although there are a lot of CVEs to go through:<p>- A timing attack if you&#x27;re using HTTP basic auth<p>- A couple of GC related DoS attacks<p>- An issue with `accepts_nested_attributes_for` if you&#x27;re using both the `allow_destroy` and `reject_if` options<p>- A validation bypass exploit if you&#x27;re calling `SomeModel.new(params[:some_model])` instead of using StrongParams<p>- An information leak exploit if you&#x27;re calling `render params[:something]` with raw user input<p>- A bunch of potential XSS exploits<p>The `render` issue looks like it could cause the most harm, but hopefully shouldn&#x27;t be too prevalent. The XSS issues should be a quick fix as you only have to update `rails-html-sanitizer`, not Rails itself.