Red Hat CVE-2026-33170
MEDIUMVulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | While a CVSS score has not been assigned by the vendor, this vulnerability demonstrates high real-world risk. The attack vector is network-based (CWE-79 XSS), the attack complexity is low (simple string formatting with user input), and privileges required are minimal (any attacker can provide format string arguments). The vulnerability is not listed in CISA's KEV catalog, but the targeted nature of SafeBuffer in Rails applications, combined with the automatic failure to escape HTML, suggests significant exploitability. The availability of patches across three recent major version lines (7.2.3.1, 8.0.4.1, 8.1.2.1) and three distinct commits indicates this was treated as high-priority by Rails maintainers. This is not a theoretical edge case but a practical XSS bypass: developers following Rails conventions and assuming HTML sanitization would be completely unaware their mutations have created an unsafe state, making this an exceptionally dangerous logic flaw rather than a low-real-risk issue. |
| Exploit ScenarioDerived | An attacker exploits this vulnerability in a Rails application that uses dynamic string building with user-supplied data. For example, an admin panel might build a SafeBuffer with a template, apply |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 23, 2026
SafeBuffer's string formatting operator (%) in Ruby fails to preserve HTML safety flags when processing untrusted input, allowing attackers to inject malicious scripts that bypass ERB auto-escaping protections. An attacker can exploit this by providing crafted arguments to the % operator on a mutated SafeBuffer, causing the resulting string to be incorrectly marked as safe and potentially leading to cross-site scripting (XSS) attacks. A patch is available for affected applications.
Earlier versions of this analysis (1)
A type confusion vulnerability exists in Ruby on Rails' SafeBuffer class where the % string formatting operator fails to propagate the @html_unsafe flag to newly created buffers, causing previously safe HTML content to be incorrectly marked as safe after in-place mutations like gsub!. This allows attackers to inject untrusted data that bypasses ERB auto-escaping protections, leading to cross-site scripting (XSS) attacks. The vulnerability affects ActiveSupport across multiple Rails versions and patches are available from the vendor.
RemediationAI
Immediately upgrade ActiveSupport to version 7.2.3.1, 8.0.4.1, 8.1.2.1 or later depending on your Rails version. These patched releases are available from the standard RubyGems repository and can be installed via bundle update activesupport. The fixes are applied in commits 50d732af3b7c8aaf63cbcca0becbc00279b215b7, 6e8a81108001d58043de9e54a06fca58962fc2db, and c1ad0e8e1972032f3395853a5e99cea035035beb, which properly propagate the @html_unsafe flag during string formatting operations. As an interim compensating control, audit templates that perform in-place mutations (gsub!, sub!, etc.) on SafeBuffer objects followed by % formatting and consider refactoring to avoid such patterns, though patching is the definitive solution.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in rubygems
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
ActiveSupport's SafeBuffer class (pkg:rubygems/activesupport) implements HTML safety tracking via an @html_unsafe flag to prevent XSS in ERB templating. When a SafeBuffer is mutated in-place via methods like gsub!, the modified buffer retains its safe status. However, when the % formatting operator is subsequently used with untrusted user arguments, it creates a new buffer object without properly copying the @html_unsafe flag from the parent. This is a type confusion issue classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). The root cause is insufficient state propagation in string formatting operations on marked-safe objects, violating the principle that any buffer containing user input should not be implicitly trusted.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
Impact
SafeBuffer#% does not propagate the @html_unsafe flag to the newly created buffer. If a SafeBuffer is mutated in place (e.g. via gsub!) and then formatted with % using untrusted arguments, the result incorrectly reports html_safe? == true, bypassing ERB auto-escaping and possibly leading to XSS.
Releases
The fixed releases are available at the normal locations.
Executive ViewAI
CVE-2026-33170 presents moderate security risk, a cross-site scripting vulnerability rated CVSS 6.1. Attackers could inject scripts to steal sessions or perform actions as authenticated users. A patch is available and should be applied during regular vulnerability management.
Apply vendor patch. If patching is delayed: implement CSP headers, enable HttpOnly cookies, deploy WAF XSS rules.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Affected Products (CPE)GitHub Advisory
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allVendor StatusVendor
SUSE
Severity: Medium| Product | Status |
|---|---|
| SUSE Linux Enterprise High Availability Extension 15 SP7 | Fixed |
| openSUSE Leap 15.6 | Fixed |
| SUSE Linux Enterprise High Availability Extension 15 SP4 | Fixed |
| SUSE Linux Enterprise High Availability Extension 15 SP5 | Fixed |
| SUSE Linux Enterprise High Availability Extension 15 | Fixed |
| SUSE Linux Enterprise High Availability Extension 15 SP1 | Fixed |
| SUSE Linux Enterprise High Availability Extension 15 SP2 | Fixed |
| SUSE Linux Enterprise High Availability Extension 15 SP3 | Fixed |
| SUSE Linux Enterprise High Availability Extension 15 SP6 | Fixed |
| openSUSE Leap 15.3 | Fixed |
| openSUSE Leap 15.4 | Fixed |
| openSUSE Leap 15.5 | Fixed |
Exploit-DB