2017/10/GHSA-78rc-8c29-p45g actionpack allows remote code execution via application's unrestricted use of render method