CVE-2026-126070

🗓️ 10 Nov 2026 20:38:50Reported by MendType

XSS in Action View strip_tags via unencoded quotes in html_safe output.

Reporter	Title	Published	Views	Family All 54
Circl	CVE-2026-126070	11 Nov 202613:03	–	circl
CVE	CVE-2026-126070	10 Nov 202620:38	–	cve
Cvelist	CVE-2026-126070 Action View: Possible XSS vulnerability in Action View strip_tags	10 Nov 202620:38	–	cvelist
Debian CVE	CVE-2026-126070	11 Nov 202614:55	–	debiancve
EUVD	EUVD-2026-122994	12 Nov 202623:39	–	euvd
Github Security Blog	Action View: Possible XSS vulnerability in strip_tags	12 Nov 202623:39	–	github
GitLab Advisory Database	Action View: Possible XSS vulnerability in strip_tags	12 Nov 202600:00	–	gitlab
NVD	CVE-2026-126070	10 Nov 202621:19	–	nvd
osv_cga	CGA-256Q-P5MH-92H9	13 Nov 202613:05	–	osv_cga
osv_cga	CGA-26QM-4F2C-3CF2	13 Nov 202613:53	–	osv_cga

Vulners

Node

rubyonrails railsRange2.3.5–2.3.16

rubyonrails railsRange3.0.0.beta1–3.0.17

rubyonrails actionviewRange8.0.0.beta1–8.0.5.2

rubyonrails actionviewRange8.1.0.beta1–8.1.4.1

rubyonrails railsRange8.0.0.alpha1–8.0.5.2

rubyonrails railsRange3.2.0.rc1–3.2.8

rubyonrails railsRange3.1.0.beta1–3.1.8

rubyonrails actionpackRange3.2.0.rc1–3.2.8

rubyonrails actionpackRange3.1.0.beta1–3.1.8

rubyonrails railsRange8.1.0.beta1–8.1.4.1

rubyonrails actionpackRange3.0.0.beta–3.0.17

Source	Link
github	www.github.com/rails/rails/security/advisories/GHSA-rq8q-p985-fjq7
github	www.github.com/rails/rails/releases/tag/v8.0.5.2
github	www.github.com/rails/rails/commit/568b19cb860322885593e308a7f27aceb779e9d7
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2026/126xxx/CVE-2026-126070.json
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-126070
github	www.github.com/rails/rails/releases/tag/v8.1.4.1
github	www.github.com/rails/rails/commit/c3772a10f405f9644125cbb484adfd2aa7a25a59

11 Nov 2026 15:45Current

6.3Medium risk

Vulners AI Score6.3

CVSS 45.3

CVSS 3.16.1

EPSS0.00269