XSS Vulnerability in Action View for Ruby on Rails by Rails
CVE-2026-33168
What is CVE-2026-33168?
The Action View component of Ruby on Rails, which assists in creating web pages, has a significant flaw that arises when a blank string is used as an HTML attribute name. In versions prior to 8.1.2.1, 8.0.4.1, and 7.2.3.1, this oversight allows attribute escaping to be bypassed, resulting in malformed HTML. An attacker can exploit this by injecting a carefully crafted attribute value that browsers may misinterpret as a distinct attribute name, potentially enabling XSS attacks. Applications permitting users to specify custom HTML attributes are particularly susceptible. It is essential to upgrade to the patched versions to mitigate this vulnerability.
Affected Version(s)
actionview >= 8.1.0.beta1, < 8.1.2.1 < 8.1.0.beta1, 8.1.2.1
actionview >= 8.0.0.beta1, < 8.0.4.1 < 8.0.0.beta1, 8.0.4.1
actionview < 7.2.3.1 < 7.2.3.1