{"id":"CVE-2026-126070","published":"2026-11-10T21:19:25.117","lastModified":"2026-11-10T21:19:25.117","description":"Action View is a framework for handling view template lookup and rendering and provides view helpers for building HTML. Prior to 8.1.4.1 and 8.0.5.2, strip_tags in Action View returns its sanitized output marked html_safe, but the underlying sanitizer encodes only &, < and >, leaving \" and ' unencoded. Because ERB does not escape a string marked html_safe, untrusted input passed through strip_tags and rendered inside a quoted HTML attribute value could close the attribute and add new attributes, possibly leading to XSS. Applications that render strip_tags output from untrusted input inside an HTML attribute, for example in a title attribute or a <meta content> tag, are affected. Output rendered as element content is not affected. This issue is fixed in versions 8.1.4.1 and 8.0.5.2.","cvssScore":6.1,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","cwes":["CWE-79"],"vendors":[],"products":[],"references":[{"url":"https://github.com/rails/rails/commit/568b19cb860322885593e308a7f27aceb779e9d7","tags":[]},{"url":"https://github.com/rails/rails/commit/c3772a10f405f9644125cbb484adfd2aa7a25a59","tags":[]},{"url":"https://github.com/rails/rails/releases/tag/v8.0.5.2","tags":[]},{"url":"https://github.com/rails/rails/releases/tag/v8.1.4.1","tags":[]},{"url":"https://github.com/rails/rails/security/advisories/GHSA-rq8q-p985-fjq7","tags":[]}],"exploitRefs":[{"url":"https://github.com/rails/rails/commit/568b19cb860322885593e308a7f27aceb779e9d7","tags":[]},{"url":"https://github.com/rails/rails/commit/c3772a10f405f9644125cbb484adfd2aa7a25a59","tags":[]},{"url":"https://github.com/rails/rails/releases/tag/v8.0.5.2","tags":[]},{"url":"https://github.com/rails/rails/releases/tag/v8.1.4.1","tags":[]},{"url":"https://github.com/rails/rails/security/advisories/GHSA-rq8q-p985-fjq7","tags":[]}],"hasPoc":true,"ai":null}