XSS Vulnerability in Active Support Libraries by Ruby on Rails
CVE-2026-33170
5.3MEDIUM
What is CVE-2026-33170?
The Active Support library prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 is vulnerable to Cross-Site Scripting (XSS). This occurs due to an issue where the 'SafeBuffer#%' method fails to carry the '@html_unsafe' flag to new buffers. Consequently, if a SafeBuffer is altered (such as using 'gsub!') and formatted with untrusted data, it may incorrectly evaluate 'html_safe?' as true. This flaw circumvents ERB's auto-escaping feature, allowing for potential XSS attacks if exploited with malicious user input. The vulnerability is addressed in the mentioned versions.
Affected Version(s)
activesupport >= 8.1.0.beta1, < 8.1.2.1 < 8.1.0.beta1, 8.1.2.1
activesupport >= 8.0.0.beta1, < 8.0.4.1 < 8.0.0.beta1, 8.0.4.1
activesupport < 7.2.3.1 < 7.2.3.1