CVE-2026-126070 Action View: Possible XSS vulnerability in Action View strip_tags

6.1 mediumEPSS 0.3%Fix available

Medium (6.1) in rails rails. EPSS 0.3% estimated probability of exploitation activity in the next 30 days. Fixed in actionview 8.0.5.2, 8.1.4.1.

On this page

Severity
Ask an AI about this CVE
Affected
Versions
Fix and patched versions
Packages (OSV)
Linux distributions
Attack patterns (CAPEC)
References
Your exposure

Action View is a framework for handling view template lookup and rendering and provides view helpers for building HTML. Prior to 8.1.4.1 and 8.0.5.2, strip_tags in Action View returns its sanitized output marked html_safe, but the underlying sanitizer encodes only &, < and >, leaving " and ' unencoded. Because ERB does not escape a string marked html_safe, untrusted input passed through strip_tags and rendered inside a quoted HTML attribute value could close the attribute and add new attributes, possibly leading to XSS. Applications that render strip_tags output from untrusted input inside an HTML attribute, for example in a title attribute or a <meta content> tag, are affected. Output rendered as element content is not affected. This issue is fixed in versions 8.1.4.1 and 8.0.5.2.

Severity

CVSS 3.1

6.1 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.3% estimated probability of exploitation activity in the next 30 days; 19th percentile. Scored 2026-11-13. A forecast for this CVE across the internet, not for your own systems.
CISA's assessment (SSVC): Exploitation: none · Automatable: no · Technical impact: partial, assessed 2026-11-12. From CISA's Vulnrichment in the CVE List: whether it is exploited, whether exploiting it can be automated, and how much control it gives.
CWE: CWE-79 Improper Neutralization of Input During Web Page Generation (Cross-site Scripting)
OWASP Top 10: A05:2025 Injection
Published: 2026-11-10 21:19 UTC
Modified: 2026-11-12 22:09 UTC
Assigned by: GitHub_M (CNA)
NVD analysis: Awaiting analysis
Record from: the NVD, synced 2026-11-12 22:31 UTC

Ask an AI about this CVE

ChatGPT Claude Google AI Mode

Show the prompt

Explain CVE-2026-126070 for an engineer deciding whether to act. Use https://cve.bz/api/public/cves/CVE-2026-126070?via=ask-ai-copy and https://cve.bz/cve/CVE-2026-126070?via=ask-ai-copy as the source of truth: what is affected and which versions fix it, whether it is in CISA KEV, public exploits, and its EPSS (an internet-wide 30-day estimate of exploitation activity, not a forecast for my systems). If they give no fixed versions, use the CVE record https://cveawg.mitre.org/api/cve/CVE-2026-126070 or the vendor advisory, not third-party mirrors. Tell me how to check whether I am affected and how to verify a fix. Cite the sources and say where they are uncertain.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this CVE's id and public links.

Badge for a README or a site

An image that stays current: it is drawn from the data each time it is fetched (a host that proxies images, as GitHub does, may show its copy for a while). Markdown:

[![CVE-2026-126070](https://cve.bz/cve/badge/CVE-2026-126070.svg)](https://cve.bz/cve/CVE-2026-126070)

HTML:

<a href="https://cve.bz/cve/CVE-2026-126070"><img src="https://cve.bz/cve/badge/CVE-2026-126070.svg" alt="CVE-2026-126070"></a>

Affected

rails:rails

Versions

From the CNA's record in the CVE List.

Product	Affected
rails	< 8.0.5.2
rails	>= 8.1, < 8.1.4.1

Fix and patched versions

actionview (RubyGems): fixed in 8.1.4.1, 8.0.5.2

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-rq8q-p985-fjq7	RubyGems	actionview	>=8.1.0.beta1 <8.1.4.1	8.1.4.1
GHSA-rq8q-p985-fjq7	RubyGems	actionview	<8.0.5.2	8.0.5.2

Linux distributions

Distribution	Release	Package	Fixed in	Advisory
Debian	12, 13, 14	rails	no fix listed	DEBIAN-CVE-2026-126070
Ubuntu	24.04:LTS, 26.04:LTS, 26.10 and 4 more	rails	no fix listed	UBUNTU-CVE-2026-126070

From the distributions' data via OSV.dev: the Debian Security Tracker; Ubuntu Security Notices © Canonical Ltd., CC BY-SA 4.0. Modified: reformatted and linked to CVE records. Credits. On the distributions' own pages: Debian · Ubuntu.

Attack patterns (CAPEC)

CAPEC-63 Cross-Site Scripting (XSS) Likelihood: High · Severity: Very High
CAPEC-85 AJAX Footprinting Likelihood: High · Severity: Low
CAPEC-209 XSS Using MIME Type Mismatch Severity: Medium
CAPEC-588 DOM-Based XSS Likelihood: High · Severity: Very High
CAPEC-591 Reflected XSS Likelihood: High · Severity: Very High
CAPEC-592 Stored XSS Likelihood: High · Severity: Very High

The attack patterns MITRE's CAPEC relates to this record's weaknesses, as MITRE names them. Credits.

References

Check your stack JSON