Red Hat CVE-2026-33170

ActiveSupport's SafeBuffer class (pkg:rubygems/activesupport) implements HTML safety tracking via an @html_unsafe flag to prevent XSS in ERB templating. When a SafeBuffer is mutated in-place via methods like gsub!, the modified buffer retains its safe status. However, when the % formatting operator is subsequently used with untrusted user arguments, it creates a new buffer object without properly copying the @html_unsafe flag from the parent. This is a type confusion issue classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). The root cause is insufficient state propagation in string formatting operations on marked-safe objects, violating the principle that any buffer containing user input should not be implicitly trusted.