Rails has a possible XSS vulnerability in its Action Pack debug exceptions

TRUNG BÌNH 6.1CVE-2026-33167 · GHSA-pgm4-439c-5jp6 · Công bố 23/03/2026 · cập nhật 12/08/2026

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
actionpack RubyGems	`≥ 8.1.0, < 8.1.2.1`	`8.1.2.1`
rails rubyonrails	`≥ 8.1.0, < 8.1.2.1`	`8.1.2.1`

Mô tả

Impact

The debug exceptions page does not properly escape exception messages. A carefully crafted exception message could inject arbitrary HTML and JavaScript into the page, leading to XSS. This affects applications with detailed exception pages enabled (config.consider_all_requests_local = true), which is the default in development.

Releases

The fixed releases are available at the normal locations.

Credit

This issue was responsibly reported by Hackerone researcher fbettag.

Mô tả của NVD

Action Pack is a Rubygem for building web applications on the Rails framework. In versions on the 8.1 branch prior to 8.1.2.1, the debug exceptions page does not properly escape exception messages. A carefully crafted exception message could inject arbitrary HTML and JavaScript into the page, leading to XSS. This affects applications with detailed exception pages enabled (`config.consider_all_requests_local = true`), which is the default in development. Version 8.1.2.1 contains a patch.