Rails has a possible XSS vulnerability in its Action View tag helpers

Rails Action View tag helpers bypass escaping for blank attribute names, risking HTML and XSS.

Reporter	Title	Published	Views	Family All 28
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities have been addressed in IBM Aspera Shares	14 May 202615:43	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities affects IBM License Metric Tool v9	27 May 202613:01	–	ibm
ATTACKERKB	CVE-2026-33168	23 Mar 202623:01	–	attackerkb
BDU FSTEC	The vulnerability of the ActionView component of the Ruby on Rails software platform allows attackers to execute arbitrary code.	25 May 202600:00	–	bdu_fstec
Chainguard	CVE-2026-33168 vulnerabilities	25 Mar 202607:23	–	cgr
Circl	CVE-2026-33168	24 Mar 202600:44	–	circl
CNNVD	Rails 跨站脚本漏洞	23 Mar 202600:00	–	cnnvd
CVE	CVE-2026-33168	23 Mar 202623:01	–	cve
Cvelist	CVE-2026-33168 Rails has a possible XSS vulnerability in its Action View tag helpers	23 Mar 202623:01	–	cvelist
Debian CVE	CVE-2026-33168	23 Mar 202623:01	–	debiancve

Vulners

Node

gem actionviewRange<7.2.3.1

gem actionviewRange8.0.0-beta.1≥

gem actionviewRange<8.0.4.1

gem actionviewRange8.1.0-beta.1≥

gem actionviewRange<8.1.2.1

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-33168
github	www.github.com/advisories/GHSA-v55j-83pf-r9cq
github	www.github.com/rails/rails/security/advisories/GHSA-v55j-83pf-r9cq
github	www.github.com/rails/rails/commit/0b6f8002b52b9c606fd6be9e7915d9f944cf539c
github	www.github.com/rails/rails/commit/63f5ad83edaa0b976f82d46988d745426aa4a42d
github	www.github.com/rails/rails/commit/c79a07df1e88738df8f68cb0ee759ad6128ca924
github	www.github.com/rails/rails/releases/tag/v7.2.3.1
github	www.github.com/rails/rails/releases/tag/v8.0.4.1
github	www.github.com/rails/rails/releases/tag/v8.1.2.1
github	www.github.com/rubysec/ruby-advisory-db/blob/master/gems/actionview/CVE-2026-33168.yml

23 Mar 2026 00:00Current

5.8Medium risk

Vulners AI Score5.8

CVSS 42.3

EPSS0.00516

SSVC