CVE-2026-33168CWE-79

Rails has a possible XSS vulnerability in its Action View tag helpers

Low · published March 23, 2026

CVSS v4.0
2.3
EPSS
1%
Percentile
51.7
In the wild
Unconfirmed
What it is

Action View provides conventions and helpers for building web pages with the Rails framework. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, when a blank string is used as an HTML attribute name in Action View tag helpers, the attribute escaping is bypassed, producing malformed HTML. A carefully crafted attribute value could then be misinterpreted by the browser as a separate attribute name, possibly leading to XSS. Applications that allow users to specify custom HTML attributes are affected. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.

The record
Technical detail
CVSS v4.0
2.3 · LOW
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00678 · 51.7th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-03-23T23:01Z
EPSS history
Timeline
  • 23 MAR 23:01Z
    Rails has a possible XSS vulnerability in its Action View tag helpers
    cvelistv5