vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2026-33168

Rails has a possible XSS vulnerability in its Action View tag helpers

LOW
2.3
CVSS Score
Published: March 23, 2026 at 11:01 PM UTC
Updated: June 17, 2026 at 10:37 AM UTC
1 product affected across 1 vendorActionview

Using rails by rails?

Get instant alerts when new vulnerabilities affect rails - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
LOW2.3
Exploit prediction
EPSS 0.7%
SSVC
No known exploit

Description

Action View provides conventions and helpers for building web pages with the Rails framework. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, when a blank string is used as an HTML attribute name in Action View tag helpers, the attribute escaping is bypassed, producing malformed HTML. A carefully crafted attribute value could then be misinterpreted by the browser as a separate attribute name, possibly leading to XSS. Applications that allow users to specify custom HTML attributes are affected. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Actionview· Rails
60%
v < 7.2.3.1v < 8.0.4.1v < 8.1.2.1
Affected range stops below 7.2.3.1, so it looks safe — our inference, not a vendor statement
Affected range stops below 8.0.4.1, so it looks safe — our inference, not a vendor statement
Affected range stops below 8.1.2.1, so it looks safe — our inference, not a vendor statement

Remediation

No guide yet

No remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.

References (7)

x_refsource_CONFIRM
Source: cverecord
https://github.com/rails/rails/security/advisories/GHSA-v55j-83pf-r9cq
x_refsource_MISC
Source: cverecord
https://github.com/rails/rails/commit/0b6f8002b52b9c606fd6be9e7915d9f944cf539c
x_refsource_MISC
Source: cverecord
https://github.com/rails/rails/commit/63f5ad83edaa0b976f82d46988d745426aa4a42d
x_refsource_MISC
Source: cverecord
https://github.com/rails/rails/commit/c79a07df1e88738df8f68cb0ee759ad6128ca924
x_refsource_MISC
Source: cverecord
https://github.com/rails/rails/releases/tag/v7.2.3.1
x_refsource_MISC
Source: cverecord
https://github.com/rails/rails/releases/tag/v8.0.4.1
x_refsource_MISC
Source: cverecord
https://github.com/rails/rails/releases/tag/v8.1.2.1

SSVC — Action Prioritization

SSVCNo known exploitNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

2.3LOWGitHub_M
Vector?

Quick Info

StatusDEFERRED
CWE
CWE-79

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card