CVE-2026-126069

🗓️ 10 Nov 2026 20:36:59Reported by MendType

Action View tag helpers produce malformed HTML via whitespace Symbol names, leading to XSS.

Reporter	Title	Published	Views	Family All 43
Circl	CVE-2026-126069	11 Nov 202613:02	–	circl
CVE	CVE-2026-126069	10 Nov 202620:36	–	cve
Cvelist	CVE-2026-126069 Action View: Possible XSS vulnerability in Action View tag helpers	10 Nov 202620:36	–	cvelist
Debian CVE	CVE-2026-126069	11 Nov 202614:55	–	debiancve
EUVD	EUVD-2026-122878	12 Nov 202622:08	–	euvd
Github Security Blog	Action View: Possible XSS vulnerability in tag helpers	12 Nov 202622:08	–	github
GitLab Advisory Database	Action View: Possible XSS vulnerability in tag helpers	12 Nov 202600:00	–	gitlab
NVD	CVE-2026-126069	10 Nov 202621:19	–	nvd
osv_cga	CGA-28F9-WVW3-8XHP	13 Nov 202614:49	–	osv_cga
osv_cga	CGA-2P2X-5VXV-WQ84	13 Nov 202613:13	–	osv_cga

Vulners

Node

rubyonrails railsRange8.0.0.alpha1–8.0.5.2

rubyonrails railsRange8.1.0.beta1–8.1.4.1

rubyonrails actionviewRange7.0.0.alpha1–8.0.5.2

rubyonrails actionpackRange3.0.0.beta–8.0.5.2

rubyonrails actionviewRange8.1.0.beta1–8.1.4.1

Source	Link
github	www.github.com/rails/rails/commit/9190210606ffe52f92fdc75637f8ff69404f22c8
github	www.github.com/rails/rails/commit/f47452533e1f28d847c63181b9d5f8b7243ef9a4
github	www.github.com/rails/rails/security/advisories/GHSA-68p9-83h6-5wpj
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-126069
github	www.github.com/rails/rails/releases/tag/v8.1.4.1
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2026/126xxx/CVE-2026-126069.json
github	www.github.com/rails/rails/releases/tag/v8.0.5.2

11 Nov 2026 15:45Current

5.4Medium risk

Vulners AI Score5.4

CVSS 42.3

CVSS 3.14.7

EPSS0.00235