CVE-2026-33170CWE-79

Rails Active Support has a possible XSS vulnerability in SafeBuffer#%

Medium · published March 23, 2026

CVSS v4.0
5.3
EPSS
0%
Percentile
26.2
In the wild
Unconfirmed
What it is

Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, `SafeBuffer#%` does not propagate the `@html_unsafe` flag to the newly created buffer. If a `SafeBuffer` is mutated in place (e.g. via `gsub!`) and then formatted with `%` using untrusted arguments, the result incorrectly reports `html_safe? == true`, bypassing ERB auto-escaping and possibly leading to XSS. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.

The record
Technical detail
CVSS v4.0
5.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00340 · 26.2th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-03-23T23:09Z
EPSS history
Timeline
  • 23 MAR 23:09Z
    Rails Active Support has a possible XSS vulnerability in SafeBuffer#%
    cvelistv5