CVE-2026-33170 Details
Description
Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, `SafeBuffer#%` does not propagate the `@html_unsafe` flag to the newly created buffer. If a `SafeBuffer` is mutated in place (e.g. via `gsub!`) and then formatted with `%` using untrusted arguments, the result incorrectly reports `html_safe? == true`, bypassing ERB auto-escaping and possibly leading to XSS. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
A vulnerability exists in the Active Support component of Ruby on Rails, specifically in versions 8.1.2.1, 8.0.4.1, and prior to 7.2.3.1. The issue arises because the SafeBuffer#% method fails to correctly transfer the @html_unsafe flag to new buffers. This flaw can be exploited by manipulating a SafeBuffer in place (such as with gsub!) and then using the % method with untrusted inputs. The result mistakenly indicates that the buffer is safe for HTML, which can bypass automatic escaping in ERB and potentially lead to cross-site scripting (XSS) attacks.
Users can upgrade to Active Support versions 8.1.2.1, 8.0.4.1, or 7.2.3.1 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 25, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| rubyonrails rails | < 7.2.3.1 >= 8.0.0, < 8.0.4.1 >= 8.1.0, < 8.1.2.1 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 24, 2026 | Initial Analysis | [email protected] |
| Mar 24, 2026 | New CVE Received | [email protected] |