XSS Vulnerability in Action View Framework by Rails
CVE-2026-126069

4.7MEDIUM

Key Information:

Vendor

Rails

Status
Rails
Vendor
CVE Published:
10 November 2026

What is CVE-2026-126069?

The Action View framework in Rails has a vulnerability that can lead to Cross-Site Scripting (XSS) attacks. This occurs when blank HTML attribute names are improperly handled by Action View's tag helpers, allowing attackers to exploit whitespace-only symbol names. If an application permits users to define custom HTML attribute names, a malicious actor could craft attribute values that are misinterpreted by the browser. This flaw could result in the generation of malformed HTML and improper execution of JavaScript, posing severe security risks. The issue has been addressed in Action View versions 8.1.4.1 and 8.0.5.2.

Affected Version(s)

rails >= 8.1, < 8.1.4.1 < 8.1, 8.1.4.1

rails < 8.0.5.2 < 8.0.5.2

References

https://github.com/rails/rails/security/advisories/GHSA-6...
x_refsource_CONFIRM
https://github.com/rails/rails/commit/9190210606ffe52f92f...
x_refsource_MISC
https://github.com/rails/rails/commit/f47452533e1f28d847c...
x_refsource_MISC

CVSS V3.1

Score:
4.7
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.