Vulnerability advisory

GHSA-v55j-83pf-r9cq

Rails has a possible XSS vulnerability in its Action View tag helpers

Published Mar 23, 2026Updated Sep 10, 2026OSV record ↗

Also known as CVE-2026-33168

Severity

CVSS 4.0CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Affected versions

actionview RubyGems

All actionview advisories →

Affected	Fixed in
`8.1.0.beta1` to before 8.1.2.1	`8.1.2.1`Advisories →
Also listed as affected (5) `8.1.0` `8.1.0.beta1` `8.1.0.rc1` `8.1.1` `8.1.2`
`8.0.0.beta1` to before 8.0.4.1	`8.0.4.1`Advisories →
Also listed as affected (10) `8.0.0` `8.0.0.1` `8.0.0.beta1` `8.0.0.rc1` `8.0.0.rc2` `8.0.1` `8.0.2` `8.0.2.1` `8.0.3` `8.0.4`
All versions before 7.2.3.1	`7.2.3.1`Advisories →
Also listed as affected (286) `4.1.0` `4.1.0.beta1` `4.1.0.beta2` `4.1.0.rc1` `4.1.0.rc2` `4.1.1` `4.1.10` `4.1.10.rc1` `4.1.10.rc2` `4.1.10.rc3` `4.1.10.rc4` `4.1.11` `4.1.12` `4.1.12.rc1` `4.1.13` `4.1.13.rc1` `4.1.14` `4.1.14.1` `4.1.14.2` `4.1.14.rc1` `4.1.14.rc2` `4.1.15` `4.1.15.rc1` `4.1.16` `4.1.16.rc1` `4.1.2` `4.1.2.rc1` `4.1.2.rc2` `4.1.2.rc3` `4.1.3` `4.1.4` `4.1.5` `4.1.6` `4.1.6.rc1` `4.1.6.rc2` `4.1.7` `4.1.7.1` `4.1.8` `4.1.9` `4.1.9.rc1` `4.2.0` `4.2.0.beta1` `4.2.0.beta2` `4.2.0.beta3` `4.2.0.beta4` `4.2.0.rc1` `4.2.0.rc2` `4.2.0.rc3` `4.2.1` `4.2.1.rc1` `4.2.1.rc2` `4.2.1.rc3` `4.2.1.rc4` `4.2.10` `4.2.10.rc1` `4.2.11` `4.2.11.1` `4.2.11.2` `4.2.11.3` `4.2.2` `4.2.3` `4.2.3.rc1` `4.2.4` `4.2.4.rc1` `4.2.5` `4.2.5.1` `4.2.5.2` `4.2.5.rc1` `4.2.5.rc2` `4.2.6` `4.2.6.rc1` `4.2.7` `4.2.7.1` `4.2.7.rc1` `4.2.8` `4.2.8.rc1` `4.2.9` `4.2.9.rc1` `4.2.9.rc2` `5.0.0` `5.0.0.1` `5.0.0.beta1` `5.0.0.beta1.1` `5.0.0.beta2` `5.0.0.beta3` `5.0.0.beta4` `5.0.0.racecar1` `5.0.0.rc1` `5.0.0.rc2` `5.0.1` `5.0.1.rc1` `5.0.1.rc2` `5.0.2` `5.0.2.rc1` `5.0.3` `5.0.4` `5.0.4.rc1` `5.0.5` `5.0.5.rc1` `5.0.5.rc2` `5.0.6` `5.0.6.rc1` `5.0.7` `5.0.7.1` `5.0.7.2` `5.1.0` `5.1.0.beta1` `5.1.0.rc1` `5.1.0.rc2` `5.1.1` `5.1.2` `5.1.2.rc1` `5.1.3` `5.1.3.rc1` `5.1.3.rc2` `5.1.3.rc3` `5.1.4` `5.1.4.rc1` `5.1.5` `5.1.5.rc1` `5.1.6` `5.1.6.1` `5.1.6.2` `5.1.7` `5.1.7.rc1` `5.2.0` `5.2.0.beta1` `5.2.0.beta2` `5.2.0.rc1` `5.2.0.rc2` `5.2.1` `5.2.1.1` `5.2.1.rc1` `5.2.2` `5.2.2.1` `5.2.2.rc1` `5.2.3` `5.2.3.rc1` `5.2.4` `5.2.4.1` `5.2.4.2` `5.2.4.3` `5.2.4.4` `5.2.4.5` `5.2.4.6` `5.2.4.rc1` `5.2.5` `5.2.6` `5.2.6.1` `5.2.6.2` `5.2.6.3` `5.2.7` `5.2.7.1` `5.2.8` `5.2.8.1` `6.0.0` `6.0.0.beta1` `6.0.0.beta2` `6.0.0.beta3` `6.0.0.rc1` `6.0.0.rc2` `6.0.1` `6.0.1.rc1` `6.0.2` `6.0.2.1` `6.0.2.2` `6.0.2.rc1` `6.0.2.rc2` `6.0.3` `6.0.3.1` `6.0.3.2` `6.0.3.3` `6.0.3.4` `6.0.3.5` `6.0.3.6` `6.0.3.7` `6.0.3.rc1` `6.0.4` `6.0.4.1` `6.0.4.2` `6.0.4.3` `6.0.4.4` `6.0.4.5` `6.0.4.6` `6.0.4.7` `6.0.4.8` `6.0.5` `6.0.5.1` `6.0.6` `6.0.6.1` `6.1.0` `6.1.0.rc1` `6.1.0.rc2` `6.1.1` `6.1.2` `6.1.2.1` `6.1.3` `6.1.3.1` `6.1.3.2` `6.1.4` `6.1.4.1` `6.1.4.2` `6.1.4.3` `6.1.4.4` `6.1.4.5` `6.1.4.6` `6.1.4.7` `6.1.5` `6.1.5.1` `6.1.6` `6.1.6.1` `6.1.7` `6.1.7.1` `6.1.7.10` `6.1.7.2` `6.1.7.3` `6.1.7.4` `6.1.7.5` `6.1.7.6` `6.1.7.7` `6.1.7.8` `6.1.7.9` `7.0.0` `7.0.0.alpha1` `7.0.0.alpha2` `7.0.0.rc1` `7.0.0.rc2` `7.0.0.rc3` `7.0.1` `7.0.10` `7.0.2` `7.0.2.1` `7.0.2.2` `7.0.2.3` `7.0.2.4` `7.0.3` `7.0.3.1` `7.0.4` `7.0.4.1` `7.0.4.2` `7.0.4.3` `7.0.5` `7.0.5.1` `7.0.6` `7.0.7` `7.0.7.1` `7.0.7.2` `7.0.8` `7.0.8.1` `7.0.8.2` `7.0.8.3` `7.0.8.4` `7.0.8.5` `7.0.8.6` `7.0.8.7` `7.0.9` `7.1.0` `7.1.0.beta1` `7.1.0.rc1` `7.1.0.rc2` `7.1.1` `7.1.2` `7.1.3` `7.1.3.1` `7.1.3.2` `7.1.3.3` `7.1.3.4` `7.1.4` `7.1.4.1` `7.1.4.2` `7.1.5` `7.1.5.1` `7.1.5.2` `7.1.6` `7.2.0` `7.2.0.beta1` `7.2.0.beta2` `7.2.0.beta3` `7.2.0.rc1` `7.2.1` `7.2.1.1` `7.2.1.2` `7.2.2` `7.2.2.1` `7.2.2.2` `7.2.3`

Description

Impact

When a blank string is used as an HTML attribute name in Action View tag helpers, the attribute escaping is bypassed, producing malformed HTML. A carefully crafted attribute value could then be misinterpreted by the browser as a separate attribute name, possibly leading to XSS. Applications that allow users to specify custom HTML attributes are affected.

GHSA-v55j-83pf-r9cq

Affected versions

actionview RubyGems

Description

Impact

Releases

Credit

References