XSS Vulnerability in Action View Framework for Rails by Ruby
CVE-2026-126078

6.1MEDIUM

Key Information:

Vendor

Rails

Status
Rails
Vendor
CVE Published:
10 November 2026

What is CVE-2026-126078?

The Action View framework in Ruby on Rails has a vulnerability that allows for Cross-Site Scripting (XSS) attacks due to improper handling of matched phrases substituted into the :highlighter string. In specific versions prior to 8.1.4.1 and 8.0.5.2, this vulnerability enables potential attackers to manipulate quoted attribute values by including malicious content. The flaw arises when user-controlled text is highlighted without adequate sanitization, leading to unsafe HTML being generated. This issue has been addressed in the latest releases.

Affected Version(s)

rails < 8.0.5.2 < 8.0.5.2

rails >= 8.1, < 8.1.4.1 < 8.1, 8.1.4.1

References

https://github.com/rails/rails/security/advisories/GHSA-v...
x_refsource_CONFIRM
https://github.com/rails/rails/commit/06938194b4fd59e1d2c...
x_refsource_MISC
https://github.com/rails/rails/commit/c796f6198837479ada1...
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.