Most recent entries from all

fkie_cve-2026-126070

Action View is a framework for handling view template lookup and rendering and provides view helpers for building HTML. Prior to 8.1.4.1 and 8.0.5.2, strip_tags in Action View returns its sanitized output marked html_safe, but the underlying sanitizer encodes only &, < and >, leaving " and ' unencoded. Because ERB does not escape a string marked html_safe, untrusted input passed through strip_tags and rendered inside a quoted HTML attribute value could close the attribute and add new attributes, possibly leading to XSS. Applications that render strip_tags output from untrusted input inside an HTML attribute, for example in a title attribute or a <meta content> tag, are affected. Output rendered as element content is not affected. This issue is fixed in versions 8.1.4.1 and 8.0.5.2.

GHSA-rq8q-p985-fjq7 — Action View: Possible XSS vulnerability in strip_tags

Affected: RubyGems: actionview

### Impact `strip_tags` in Action View returns its sanitized output marked `html_safe`, but the underlying sanitizer encodes only `&`, `<` and `>`, leaving `"` and `'` unencoded. Because ERB does not escape a string marked `html_safe`, untrusted input passed through `strip_tags` and rendered inside a quoted HTML attribute value could close the attribute and add new attributes, possibly leading to XSS. Applications that render `strip_tags` output from untrusted input inside an HTML attribute, for example in a `title` attribute or a `<meta content>` tag, are affected. Output rendered as element content is not affected.

### Details `strip_tags` now encodes `"` and `'` in its output, as well as `&`, `<` and `>`, without double-encoding existing entities. Applications that use `strip_tags` output outside HTML, such as in a text template or JSON, now see `"` and `'` where they saw `"` and `'`; `CGI.unescapeHTML` decodes them. See the Action View CHANGELOG.

### Workarounds Pass `strip_tags` output to an attribute through a tag helper, which escapes attribute values, for example `tag.a(title: strip_tags(user_input))`.

### Releases The fixed releases are available at the normal locations.

Patches for those who cannot upgrade at once: - 8.1: https://github.com/rails/rails/commit/568b19cb860322885593e308a7f27aceb779e9d7.patch - 8.0: https://github.com/rails/rails/commit/c3772a10f405f9644125cbb484adfd2aa7a25a59.patch

### Credit This issue was responsibly reported by Hacker…

UBUNTU-CVE-2026-126070

Affected: Ubuntu:Pro:16.04:LTS: rails, Ubuntu:Pro:18.04:LTS: rails, Ubuntu:Pro:20.04:LTS: rails, Ubuntu:Pro:22.04:LTS: rails, Ubuntu:24.04:LTS: rails, Ubuntu:26.10: rails, Ubuntu:26.04:LTS: rails

WID-SEC-W-2026-4317 — Ruby on Rails: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in Ruby on Rails ausnutzen, um beliebigen Programmcode auszuführen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Daten zu manipulieren, um falsche Informationen darzustellen, um einen Cross-Site Scripting Angriff durchzuführen und um Sicherheitsvorkehrungen zu umgehen.