CVE search · CVE-2026-126070
CVE-2026-126070
medium 6.1
Action View is a framework for handling view template lookup and rendering and provides view helpers for building HTML. Prior to 8.1.4.1 and 8.0.5.2, strip_tags in Action View returns its sanitized output marked html_safe, but the underlying sanitizer encodes only &, < and >, leaving " and ' unencoded. Because ERB does not escape a string marked html_safe, untrusted input passed through strip_tags and rendered inside a quoted HTML attribute value could close the attribute and add new attributes, possibly leading to XSS. Applications that render strip_tags output from untrusted input inside an HTML attribute, for example in a title attribute or a <meta content> tag, are affected. Output rendered as element content is not affected. This issue is fixed in versions 8.1.4.1 and 8.0.5.2.
Details
- Status
- Received
- Published
- Last changed
- Source
- security-advisories@github.com
- Weakness
- CWE-79
Severity
| Version | Score | Vector | Source |
|---|---|---|---|
| CVSS 3.1 | medium 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
security-advisories@github.comSecondary |
References
- https://github.com/rails/rails/commit/568b19cb860322885593e308a7f27aceb779e9d7
- https://github.com/rails/rails/commit/c3772a10f405f9644125cbb484adfd2aa7a25a59
- https://github.com/rails/rails/releases/tag/v8.0.5.2
- https://github.com/rails/rails/releases/tag/v8.1.4.1
- https://github.com/rails/rails/security/advisories/GHSA-rq8q-p985-fjq7