CVE-2026-33168
XSS Vulnerability in Rails Action View via Malformed HTML Attributes
Publication date: 2026-03-23
Last updated on: 2026-03-23
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| rubyonrails | action_view | to 7.2.3.1 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Action View component of the Rails framework, which helps build web pages. Before certain patched versions, if a blank string was used as an HTML attribute name in Action View tag helpers, the escaping of that attribute was bypassed. This caused malformed HTML to be generated.
Because of this malformed HTML, a carefully crafted attribute value could be interpreted by the browser as a separate attribute name, which could lead to cross-site scripting (XSS) attacks.
Applications that allow users to specify custom HTML attributes are particularly affected by this issue.
How can this vulnerability impact me? :
This vulnerability can lead to cross-site scripting (XSS) attacks, where an attacker injects malicious scripts into web pages viewed by other users.
Such XSS attacks can compromise user data, hijack user sessions, deface websites, or redirect users to malicious sites.
If your application allows users to specify custom HTML attributes and uses vulnerable versions of Action View, it may be exposed to these risks.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade the Action View component of the Rails framework to one of the patched versions: 8.1.2.1, 8.0.4.1, or 7.2.3.1.
Additionally, review your application code to ensure it does not allow users to specify custom HTML attributes that could exploit this issue.