CVE-2026-33168 Details
Description
Action View provides conventions and helpers for building web pages with the Rails framework. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, when a blank string is used as an HTML attribute name in Action View tag helpers, the attribute escaping is bypassed, producing malformed HTML. A carefully crafted attribute value could then be misinterpreted by the browser as a separate attribute name, possibly leading to XSS. Applications that allow users to specify custom HTML attributes are affected. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
A vulnerability in the Action View component of Ruby on Rails has been identified, which could lead to cross-site scripting (XSS) attacks. This issue affects versions 8.1.2.1, 8.0.4.1, and 7.2.3.1. The vulnerability arises when a blank string is used as an HTML attribute name in Action View tag helpers. In such cases, the normal escaping of attributes is bypassed, resulting in malformed HTML. This malformed HTML can be exploited by crafting a specific attribute value that the browser misinterprets as a separate attribute name, potentially leading to XSS. Applications that permit users to specify custom HTML attributes are particularly vulnerable.
Users can upgrade to Ruby on Rails versions 8.1.2.1, 8.0.4.1, or 7.2.3.1, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Mar 23, 2026CISA-ADP
Assessed Mar 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/rails/rails/commit/0b6f8002b52b9c606fd6be9e7915d9f944cf539c | [email protected] | Source CodeVendor |
| https://github.com/rails/rails/commit/63f5ad83edaa0b976f82d46988d745426aa4a42d | [email protected] | Source CodeVendor |
| https://github.com/rails/rails/commit/c79a07df1e88738df8f68cb0ee759ad6128ca924 | [email protected] | Source CodeVendor |
| https://github.com/rails/rails/releases/tag/v7.2.3.1 | [email protected] | Release NotesVendor |
| https://github.com/rails/rails/releases/tag/v8.0.4.1 | [email protected] | Release NotesVendor |
| https://github.com/rails/rails/releases/tag/v8.1.2.1 | [email protected] | Release NotesVendor |
| https://github.com/rails/rails/security/advisories/GHSA-v55j-83pf-r9cq | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Ruby on Rails Action View | >= 8.1, < 8.1.2.1 >= 8.0, < 8.0.4.1 < 7.2.3.1 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 23, 2026 | New CVE Received | [email protected] |