CVE-2026-33170Rails Active Support has a possible XSS vulnerability in SafeBuffer#%
Updated under an hour ago ()
Does this affect you?
It affects rails activesupport and 1 other product. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, `SafeBuffer#%` does not propagate the `@html_unsafe` flag to the newly created buffer. If a `SafeBuffer` is mutated in place (e.g. via `gsub!`) and then formatted with `%` using untrusted arguments, the result incorrectly reports `html_safe? == true`, bypassing ERB auto-escaping and possibly leading to XSS. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
- CVSS
- 5.3 MEDIUM (v4.0, CNA)CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
- Weakness (CWE)
- CWE-79
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- GitHub_M
- NVD analysis
- Analyzed
- Record last updated
- Mar 25, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
rails activesupport rails:activesupport (from the name) | from 8.1.0.beta1, < 8.1.2.1; from 8.0.0.beta1, < 8.0.4.1; before 7.2.3.1 | CNA record |
rubyonrails rails rubyonrails:rails | before 7.2.3.1; from 8.0.0 before 8.0.4.1; from 8.1.0 before 8.1.2.1 | NVD |
References
- https://github.com/rails/rails/security/advisories/GHSA-89vf-4333-qx8vx-refsource-confirm, vendor-advisory
- https://github.com/rails/rails/commit/50d732af3b7c8aaf63cbcca0becbc00279b215b7x-refsource-misc, patch
- https://github.com/rails/rails/commit/6e8a81108001d58043de9e54a06fca58962fc2dbx-refsource-misc, patch
- https://github.com/rails/rails/commit/c1ad0e8e1972032f3395853a5e99cea035035bebx-refsource-misc, patch
- https://github.com/rails/rails/releases/tag/v7.2.3.1x-refsource-misc, release-notes
- https://github.com/rails/rails/releases/tag/v8.0.4.1x-refsource-misc, release-notes
- https://github.com/rails/rails/releases/tag/v8.1.2.1x-refsource-misc, release-notes
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.