GitHub Advisoryadvisory · RubyGems

GHSA-v55j-83pf-r9cq Rails has a possible XSS vulnerability in its Action View tag helpers

LOW Published 2026-03-23 Modified 2026-05-13 Official page ↗
Aliases
CVE-2026-33168
Ecosystem
RubyGems
Packages
actionview
Severity
Low
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-79
Reviewed
2026-03-23

Affected packages

• RubyGems actionview: >= 8.1.0.beta1, < 8.1.2.1 → fixed in 8.1.2.1 • RubyGems actionview: >= 8.0.0.beta1, < 8.0.4.1 → fixed in 8.0.4.1 • RubyGems actionview: < 7.2.3.1 → fixed in 7.2.3.1

Description

Impact When a blank string is used as an HTML attribute name in Action View tag helpers, the attribute escaping is bypassed, producing malformed HTML. A carefully crafted attribute value could then be misinterpreted by the browser as a separate attribute name, possibly leading to XSS. Applications that allow users to specify custom HTML attributes are affected. Releases The fixed releases are available at the normal locations. Credit This issue was responsibly reported by Hackerone researcher taise.

Related

Alias · CVE (1)

  • CVE-2026-33168 Action View provides conventions and helpers for building web pages with the Rails framework. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References