CVE-2019-13146: The field_test gem 0.3.0 for Ruby has unvalidated input.

Security readout for executives and security teams

CVE-2019-13146 concerns the Ruby field_test gem 0.3.0. The reported issue lets a value expected to come from a fixed set instead become arbitrary input. Business risk depends entirely on how an application uses that value, especially if it is trusted in database queries, rendered content, or security decisions. Exposure is most likely in Ruby applications using field_test 0.3.0 where variant values influence sensitive logic without independent validation. Applications not using this gem, not on 0.3.0, or validating returned values before use have less likely exposure. Treat this as a targeted dependency validation task, not an emergency by current evidence. Prioritize applications that use Ruby field_test 0.3.0 in user-facing decision, rendering, or data-access paths. Absence of CVSS and exploitation evidence lowers certainty, not the need to verify exposure. Mitigation focus: Inventory Ruby dependency manifests for field_test 0.3.0.; Check the gem page and GitHub issue for maintainer guidance.; Validate variant values against an application-owned allowlist before use..

Prepared

Jun 6, 2026, 20:22 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.