--- title: GHSA-744p-w4gc-m3gh (trilogy): SQL injection through... description: Trilogy's escape method produced unsafe SQL output for strings in Shift_JIS, Windows-31J, Big5, GBK or GB18030 encodings. In those encodings a multi-byte... canonical: https://daily.dev/posts/ghsa-744p-w4gc-m3gh-trilogy-sql-injection-through-trilogy-escape-with-multibyte-encodings-o1nvhvcbw twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: GHSA-744p-w4gc-m3gh (trilogy): SQL injection through `Trilogy#escape` with multibyte encodings | daily.dev og:description: Trilogy's escape method produced unsafe SQL output for strings in Shift_JIS, Windows-31J, Big5, GBK or GB18030 encodings. In those encodings a multi-byte... og:url: https://daily.dev/posts/ghsa-744p-w4gc-m3gh-trilogy-sql-injection-through-trilogy-escape-with-multibyte-encodings-o1nvhvcbw og:image: https://api.daily.dev/og/posts/O1NvhVCbw.png og:image:alt: GHSA-744p-w4gc-m3gh (trilogy): SQL injection through `Trilogy#escape` with multibyte encodings og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # GHSA-744p-w4gc-m3gh (trilogy): SQL injection through `Trilogy#escape` with multibyte encodings **[RUBYLAND](https://daily.dev/sources/rubyla)** · 1 min read · 0 upvotes · 0 comments ## Summary Trilogy's escape method produced unsafe SQL output for strings in Shift_JIS, Windows-31J, Big5, GBK or GB18030 encodings. In those encodings a multi-byte character's continuation byte can fall in the ASCII range, which Trilogy#escape didn't handle, enabling unauthenticated SQL injection. Ruby on Rails and other Rack apps using the Trilogy adapter are likely affected. Connections configured with sjis, cp932, big5, gbk or gb18030 encodings never worked correctly and now raise an ArgumentError. The fix ships in version 2.13.2. Anthropic's OSS Scanner discovered the issue. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Is the trilogy gem for Ruby vulnerable to SQL injection? Yes, versions before 2.13.2 are vulnerable. Trilogy#escape produced unsafe output for strings in Shift_JIS, Windows-31J, Big5, GBK or GB18030 encodings because a multi-byte character's continuation byte can fall in the ASCII range, allowing unauthenticated SQL injection. Ruby on Rails and other Rack apps using the Trilogy adapter are likely affected. Upgrade to 2.13.2 or later. _Teams running Rails with Trilogy can track advisories like this one on daily.dev to catch unpatched SQL injection risks._ ### Can I still connect to MySQL with sjis, cp932, big5, gbk or gb18030 encoding using Trilogy? No, as of version 2.13.2 these connection encodings are no longer supported and raise an ArgumentError. They never worked correctly and contributed to a SQL injection vulnerability in Trilogy#escape. Applications unable to upgrade can work around the issue by enforcing the encoding of all strings passed to Trilogy#escape and Trilogy#query. _daily.dev keeps developers migrating encoding configs informed on breaking changes like this one._ ### Who discovered the Trilogy SQL injection vulnerability GHSA-744p-w4gc-m3gh? Anthropic's OSS Scanner discovered the vulnerability, tracked internally as ANT-2026-9KOHJMNW. It affects Trilogy versions before 2.13.2, where Trilogy#escape mishandled multibyte encodings like Shift_JIS, Big5, GBK, GB18030 and Windows-31J, enabling unauthenticated SQL injection in Ruby on Rails and other Rack applications. _Security-conscious teams watching AI-assisted vulnerability discovery follow disclosures like this on daily.dev._ ## Similar posts on daily.dev - [SQL injection in the Trilogy MySQL adapter](https://daily.dev/posts/sql-injection-in-the-trilogy-mysql-adapter-ovgpcs04t) · RUBYLAND · 0 upvotes · 0 comments - [GHSA-qmpg-8xg6-ph5q \(action\_text-trix\): Trix has a Stored XSS vulnerability through serialized attributes](https://daily.dev/posts/ghsa-qmpg-8xg6-ph5q-action-text-trix-trix-has-a-stored-xss-vulnerability-through-serialized-attri-u8bd02ehq) · RUBYLAND · 0 upvotes · 0 comments - [Command injection in the spatial\_features Ruby gem](https://daily.dev/posts/command-injection-in-the-spatial-features-ruby-gem-umejnap4o) · Ruby Flow · 0 upvotes · 0 comments - [Safer secrets, ZJIT, and more\!](https://daily.dev/posts/safer-secrets-zjit-and-more--gfmhoyk3i) · This Week in Rails · 1 upvotes · 0 comments --- Tags: [#sql](https://daily.dev/tags/sql), [#ruby](https://daily.dev/tags/ruby), [#rails](https://daily.dev/tags/rails), [#mysql](https://daily.dev/tags/mysql) [View this post on daily.dev](https://daily.dev/posts/ghsa-744p-w4gc-m3gh-trilogy-sql-injection-through-trilogy-escape-with-multibyte-encodings-o1nvhvcbw) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"GHSA-744p-w4gc-m3gh (trilogy): SQL injection through `Trilogy#escape` with multibyte encodings","url":"https://daily.dev/posts/ghsa-744p-w4gc-m3gh-trilogy-sql-injection-through-trilogy-escape-with-multibyte-encodings-o1nvhvcbw","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/ghsa-744p-w4gc-m3gh-trilogy-sql-injection-through-trilogy-escape-with-multibyte-encodings-o1nvhvcbw"},"datePublished":"2026-10-31T15:21:08.181Z","dateModified":"2026-10-31T15:21:31.276Z","description":"Trilogy's escape method produced unsafe SQL output for strings in Shift_JIS, Windows-31J, Big5, GBK or GB18030 encodings. In those encodings a multi-byte...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/5fa7bf38a8a9c178c1d458f9f735556c?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/5fa7bf38a8a9c178c1d458f9f735556c?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"RUBYLAND","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"RUBYLAND","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/rubyla","url":"https://daily.dev/sources/rubyla"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/ghsa-744p-w4gc-m3gh-trilogy-sql-injection-through-trilogy-escape-with-multibyte-encodings-o1nvhvcbw","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"sql,ruby,rails,mysql","timeRequired":"PT1M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"RUBYLAND","item":"https://daily.dev/sources/rubyla"},{"@type":"ListItem","position":3,"name":"GHSA-744p-w4gc-m3gh (trilogy): SQL injection through `Trilogy#escape` with multibyte encodings"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/ghsa-744p-w4gc-m3gh-trilogy-sql-injection-through-trilogy-escape-with-multibyte-encodings-o1nvhvcbw#faq","mainEntity":[{"@type":"Question","name":"Is the trilogy gem for Ruby vulnerable to SQL injection?","acceptedAnswer":{"@type":"Answer","text":"Yes, versions before 2.13.2 are vulnerable. Trilogy#escape produced unsafe output for strings in Shift_JIS, Windows-31J, Big5, GBK or GB18030 encodings because a multi-byte character's continuation byte can fall in the ASCII range, allowing unauthenticated SQL injection. Ruby on Rails and other Rack apps using the Trilogy adapter are likely affected. Upgrade to 2.13.2 or later. Teams running Rails with Trilogy can track advisories like this one on daily.dev to catch unpatched SQL injection risks."}},{"@type":"Question","name":"Can I still connect to MySQL with sjis, cp932, big5, gbk or gb18030 encoding using Trilogy?","acceptedAnswer":{"@type":"Answer","text":"No, as of version 2.13.2 these connection encodings are no longer supported and raise an ArgumentError. They never worked correctly and contributed to a SQL injection vulnerability in Trilogy#escape. Applications unable to upgrade can work around the issue by enforcing the encoding of all strings passed to Trilogy#escape and Trilogy#query. daily.dev keeps developers migrating encoding configs informed on breaking changes like this one."}},{"@type":"Question","name":"Who discovered the Trilogy SQL injection vulnerability GHSA-744p-w4gc-m3gh?","acceptedAnswer":{"@type":"Answer","text":"Anthropic's OSS Scanner discovered the vulnerability, tracked internally as ANT-2026-9KOHJMNW. It affects Trilogy versions before 2.13.2, where Trilogy#escape mishandled multibyte encodings like Shift_JIS, Big5, GBK, GB18030 and Windows-31J, enabling unauthenticated SQL injection in Ruby on Rails and other Rack applications. Security-conscious teams watching AI-assisted vulnerability discovery follow disclosures like this on daily.dev."}}]} ```