https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-11-13T11:52:03.754276+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/fkie_cve-2026-126070 fkie_cve-2026-126070 2026-11-13T11:52:03.756346+00:00

Action View is a framework for handling view template lookup and rendering and provides view helpers for building HTML. Prior to 8.1.4.1 and 8.0.5.2, strip_tags in Action View returns its sanitized output marked html_safe, but the underlying sanitizer encodes only &, < and >, leaving " and ' unencoded. Because ERB does not escape a string marked html_safe, untrusted input passed through strip_tags and rendered inside a quoted HTML attribute value could close the attribute and add new attributes, possibly leading to XSS. Applications that render strip_tags output from untrusted input inside an HTML attribute, for example in a title attribute or a <meta content> tag, are affected. Output rendered as element content is not affected. This issue is fixed in versions 8.1.4.1 and 8.0.5.2.

 https://db.gcve.eu/vuln/ghsa-rq8q-p985-fjq7 GHSA-rq8q-p985-fjq7 — Action View: Possible XSS vulnerability in strip_tags 2026-11-13T11:52:03.756423+00:00

Affected: RubyGems: actionview

### Impact `strip_tags` in Action View returns its sanitized output marked `html_safe`, but the underlying sanitizer encodes only `&`, `<` and `>`, leaving `"` and `'` unencoded. Because ERB does not escape a string marked `html_safe`, untrusted input passed through `strip_tags` and rendered inside a quoted HTML attribute value could close the attribute and add new attributes, possibly leading to XSS. Applications that render `strip_tags` output from untrusted input inside an HTML attribute, for example in a `title` attribute or a `<meta content>` tag, are affected. Output rendered as element content is not affected.

### Details `strip_tags` now encodes `"` and `'` in its output, as well as `&`, `<` and `>`, without double-encoding existing entities. Applications that use `strip_tags` output outside HTML, such as in a text template or JSON, now see `&quot;` and `&#39;` where they saw `"` and `'`; `CGI.unescapeHTML` decodes them. See the Action View CHANGELOG.

### Workarounds Pass `strip_tags` output to an attribute through a tag helper, which escapes attribute values, for example `tag.a(title: strip_tags(user_input))`.

### Releases The fixed releases are available at the normal locations.

Patches for those who cannot upgrade at once: - 8.1: https://github.com/rails/rails/commit/568b19cb860322885593e308a7f27aceb779e9d7.patch - 8.0: https://github.com/rails/rails/commit/c3772a10f405f9644125cbb484adfd2aa7a25a59.patch

### Credit This issue was responsibly reported by Hacker…

 https://db.gcve.eu/vuln/ubuntu-cve-2026-126070 UBUNTU-CVE-2026-126070 2026-11-13T11:52:03.756478+00:00

Affected: Ubuntu:Pro:16.04:LTS: rails, Ubuntu:Pro:18.04:LTS: rails, Ubuntu:Pro:20.04:LTS: rails, Ubuntu:Pro:22.04:LTS: rails, Ubuntu:24.04:LTS: rails, Ubuntu:26.10: rails, Ubuntu:26.04:LTS: rails

Action View is a framework for handling view template lookup and rendering and provides view helpers for building HTML. Prior to 8.1.4.1 and 8.0.5.2, strip_tags in Action View returns its sanitized output marked html_safe, but the underlying sanitizer encodes only &, < and >, leaving " and ' unencoded. Because ERB does not escape a string marked html_safe, untrusted input passed through strip_tags and rendered inside a quoted HTML attribute value could close the attribute and add new attributes, possibly leading to XSS. Applications that render strip_tags output from untrusted input inside an HTML attribute, for example in a title attribute or a <meta content> tag, are affected. Output rendered as element content is not affected. This issue is fixed in versions 8.1.4.1 and 8.0.5.2.

 https://db.gcve.eu/vuln/wid-sec-w-2026-4317 WID-SEC-W-2026-4317 — Ruby on Rails: Mehrere Schwachstellen 2026-11-13T11:52:03.756516+00:00

Ein Angreifer kann mehrere Schwachstellen in Ruby on Rails ausnutzen, um beliebigen Programmcode auszuführen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Daten zu manipulieren, um falsche Informationen darzustellen, um einen Cross-Site Scripting Angriff durchzuführen und um Sicherheitsvorkehrungen zu umgehen.