Active Support Vulnerability in Ruby on Rails by Rails
CVE-2026-126075

4.7MEDIUM

Key Information:

Vendor

Rails

Status
Rails
Vendor
CVE Published:
10 November 2026

What is CVE-2026-126075?

Active Support, a component used in Ruby on Rails and other Ruby projects, has a vulnerability that arises during the serialization of ActiveSupport::SafeBuffer when utilizing the MessagePack serializer. In versions 8.1 through 8.1.4.1, the serializer mistakenly treats SafeBuffer as simple bytes, enabling it to restore the SafeBuffer as html_safe, even if it has been modified to contain untrusted input. This critical oversight can allow attackers to exploit the rendered output, bypassing ERB auto-escaping and leading to potential cross-site scripting (XSS) attacks. Users of Rails applications must assess their usage of MessagePack serializers to mitigate this risk, as earlier versions of Rails do not replicate this serialization behavior.

Affected Version(s)

rails >= 8.1, < 8.1.4.1

References

https://github.com/rails/rails/security/advisories/GHSA-2...
x_refsource_CONFIRM
https://github.com/rails/rails/commit/4ca090665976e6fbc47...
x_refsource_MISC
https://github.com/rails/rails/releases/tag/v8.1.4.1
x_refsource_MISC

CVSS V3.1

Score:
4.7
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.