XSS Vulnerability in Action View Framework Affecting Ruby on Rails
CVE-2026-126070

6.1MEDIUM

Key Information:

Vendor

Rails

Status
Rails
Vendor
CVE Published:
10 November 2026

What is CVE-2026-126070?

A vulnerability exists in the Action View framework of Ruby on Rails that allows untrusted input to be improperly rendered. Previously, the strip_tags method did not adequately sanitize output marked as html_safe, failing to encode single and double quotes. This deficiency could enable attackers to close HTML attributes and inject malicious content when rendering untrusted input within certain HTML attributes, such as in a title or <meta content> tag. The issue has been resolved in versions 8.1.4.1 and 8.0.5.2, thereby addressing the risk of XSS in affected applications.

Affected Version(s)

rails < 8.0.5.2 < 8.0.5.2

rails >= 8.1, < 8.1.4.1 < 8.1, 8.1.4.1

References

https://github.com/rails/rails/security/advisories/GHSA-r...
x_refsource_CONFIRM
https://github.com/rails/rails/commit/568b19cb86032288559...
x_refsource_MISC
https://github.com/rails/rails/commit/c3772a10f405f964412...
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.