Action View CVE-2026-33168
LOWVulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | While CVSS and EPSS scores are not available in the intelligence data, the vulnerability carries significant real-world risk due to its XSS nature (CWE-79), direct applicability to user-facing web applications, and the explicit mention that it affects applications allowing custom HTML attributes—a common pattern in content management systems, admin panels, and dynamic web frameworks. The availability of patches across three recent Rails versions (7.2.3.1, 8.0.4.1, 8.1.2.1) indicates the Rails maintainers classified this as exploitable and requiring urgent remediation. The attack vector is likely network-based with low complexity (no privileges required), and the technical impact is high (arbitrary JavaScript execution). The presence of GitHub Security Advisory (GHSA-v55j-83pf-r9cq) and multiple specific commit patches indicate this has been formally disclosed and analyzed; organizations running Rails versions prior to the patched releases should treat this as a critical priority, particularly if they handle user-generated content or allow attribute customization. |
| Exploit ScenarioDerived | An attacker could craft a URL or form submission that includes a blank attribute name in a Rails tag helper (e.g., by submitting user data that populates an attribute name field with an empty string), causing the subsequent attribute value to be parsed by the browser as a separate attribute. For example, a malicious payload could result in HTML like |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 23, 2026
A cross-site scripting (XSS) vulnerability exists in Ruby on Rails Action View tag helpers when blank strings are used as HTML attribute names, allowing attribute escaping to be bypassed and producing malformed HTML. Applications that permit users to specify custom HTML attributes are vulnerable, potentially enabling attackers to inject arbitrary JavaScript that executes in users' browsers. Patches are available from the Rails vendor across multiple affected versions (7.2.3.1, 8.0.4.1, and 8.1.2.1), and remediation should be prioritized for user-facing Rails applications accepting custom attribute inputs.
RemediationAI
Immediately upgrade Ruby on Rails to patched versions: 7.2.3.1 or later for the 7.2 series, 8.0.4.1 or later for the 8.0 series, or 8.1.2.1 or later for the 8.1 series. Patches are available at the standard Rails distribution channels and GitHub (https://github.com/rails/rails/commit/0b6f8002b52b9c606fd6be9e7915d9f944cf539c, https://github.com/rails/rails/commit/63f5ad83edaa0b976f82d46988d745426aa4a42d, https://github.com/rails/rails/commit/c79a07df1e88738df8f68cb0ee759ad6128ca924). Until patching is complete, audit all application code that accepts user-supplied HTML attributes, validate and sanitize attribute names to reject blank strings, and consider implementing a Content Security Policy (CSP) with strict script-src directives to mitigate XSS impact.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in rubygems
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in the Ruby on Rails Action View component (CPE: pkg:rubygems/actionview), which is responsible for rendering HTML templates and sanitizing user-supplied input for HTML attributes. The root cause is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation), indicating that attribute escaping logic fails when an attribute name is a blank string, causing subsequent attribute values to be misinterpreted by the browser as attribute names rather than values. This bypasses the framework's built-in cross-site scripting protections, allowing attackers to inject malicious attributes that the browser parses as separate HTML attributes, potentially containing event handlers (onclick, onload, etc.) that execute JavaScript in the victim's security context.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
3DescriptionGitHub Advisory
Impact
When a blank string is used as an HTML attribute name in Action View tag helpers, the attribute escaping is bypassed, producing malformed HTML. A carefully crafted attribute value could then be misinterpreted by the browser as a separate attribute name, possibly leading to XSS. Applications that allow users to specify custom HTML attributes are affected.
Releases
The fixed releases are available at the normal locations.
Executive ViewAI
CVE-2026-33168 is a low-severity vulnerability involving cross-site scripting. The limited severity suggests constrained impact, typically requiring specific conditions or local access for exploitation. A patch is available and can be applied during standard maintenance windows.
Apply vendor patch during routine maintenance. Standard cross-site scripting mitigations apply if patching is delayed.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Exploit-DB