Rails has a possible XSS vulnerability in its Action Pack debug exceptions

MEDIUM 6.1CVE-2026-33167 · GHSA-pgm4-439c-5jp6 · Published 23/03/2026 · updated 12/08/2026

Package	Affected versions	Patched versions
actionpack RubyGems	`≥ 8.1.0, < 8.1.2.1`	`8.1.2.1`
rails rubyonrails	`≥ 8.1.0, < 8.1.2.1`	`8.1.2.1`

Description

Impact

The debug exceptions page does not properly escape exception messages. A carefully crafted exception message could inject arbitrary HTML and JavaScript into the page, leading to XSS. This affects applications with detailed exception pages enabled (config.consider_all_requests_local = true), which is the default in development.

Releases

The fixed releases are available at the normal locations.

Credit

This issue was responsibly reported by Hackerone researcher fbettag.

NVD description

Action Pack is a Rubygem for building web applications on the Rails framework. In versions on the 8.1 branch prior to 8.1.2.1, the debug exceptions page does not properly escape exception messages. A carefully crafted exception message could inject arbitrary HTML and JavaScript into the page, leading to XSS. This affects applications with detailed exception pages enabled (`config.consider_all_requests_local = true`), which is the default in development. Version 8.1.2.1 contains a patch.

References

rails/rails security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2026-33167 · ADVISORY
rails/rails commit 6752711 · WEB
rails/rails · PACKAGE
rails/rails release v8.1.2.1 · WEB
rubysec/ruby-advisory-db · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

actionpack

RubyGems

≥ 8.1.0, < 8.1.2.1

8.1.2.1

rails

rubyonrails

≥ 8.1.0, < 8.1.2.1

8.1.2.1

Description

Impact

Releases

The fixed releases are available at the normal locations.

Credit

This issue was responsibly reported by Hackerone researcher fbettag.

NVD description