CVE-2026-126070: Cross-Site Scripting in Ruby on Rails Action View strip_tags Helper

Vulnerability ID: CVE-2026-126070
CVSS Score: 6.1
Published: 2026-11-12

CVE-2026-126070 is a Cross-Site Scripting (XSS) vulnerability in the Action View component of Ruby on Rails. Prior to versions 8.0.5.2 and 8.1.4.1, the strip_tags helper returned sanitized output marked as html_safe without encoding single or double quotation marks. When applications render the output of strip_tags inside quoted HTML attributes in ERB templates, attackers can break out of the attribute context and inject arbitrary HTML attributes or JavaScript event handlers.

TL;DR

Action View's strip_tags helper marks its output as html_safe without encoding quotation marks, allowing attackers to break out of quoted HTML attributes and achieve Cross-Site Scripting (XSS). Upgrade to Ruby on Rails 8.0.5.2 or 8.1.4.1.

⚠️ Exploit Status: POC

Technical Details

• CVE ID: CVE-2026-126070 (GHSA-rq8q-p985-fjq7)
• Vulnerability Class: CWE-79: Cross-Site Scripting (XSS)
• Affected Component: Action View (ActionView::Helpers::SanitizeHelper#strip_tags)
• CVSS v3.1 Score: 6.1 Medium (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
• EPSS Score: 0.27% (19.25th Percentile)
• Exploit Status: PoC Confirmed in Unit Tests (Not in CISA KEV)
• Patched Versions: Rails 8.0.5.2, Rails 8.1.4.1

Affected Systems

• Ruby on Rails (Action View)
• rails (actionview): < 8.0.5.2 (Fixed in: 8.0.5.2)
• rails (actionview): >= 8.1.0, < 8.1.4.1 (Fixed in: 8.1.4.1)

Code Analysis

Commit: 568b19c

Fix strip_tags to encode " and ' in its output [GHSA-rq8q-p985-fjq7]

diff --git a/actionview/lib/action_view/helpers/sanitize_helper.rb b/actionview/lib/action_view/helpers/sanitize_helper.rb
--- a/actionview/lib/action_view/helpers/sanitize_helper.rb
+++ b/actionview/lib/action_view/helpers/sanitize_helper.rb
@@ -137,7 +141,8 @@ def sanitize_css(style)
       def strip_tags(html)
-        self.class.full_sanitizer.sanitize(html)&.html_safe
+        stripped = self.class.full_sanitizer.sanitize(html)
+        ERB::Util.html_escape_once(stripped) if stripped
       end

Commit: c3772a1

Backport fix for strip_tags to encode " and ' in its output [GHSA-rq8q-p985-fjq7]

Mitigation Strategies

• Upgrade Ruby on Rails (actionview) to version 8.0.5.2, 8.1.4.1, or later.
• Wrap strip_tags calls with ERB::Util.html_escape_once when rendering inside quoted HTML attributes on unpatched versions.
• Audit application views to ensure strip_tags and sanitize outputs are never placed in unquoted HTML attributes, and that sanitize output is only used as element content.
• Implement a strict Content Security Policy (CSP) that disallows inline script execution (unsafe-inline) to mitigate the impact of injected inline event handlers.

Remediation Steps:

1. Identify all instances of rails / actionview in your Gemfile.lock and verify if the version is < 8.0.5.2 or >= 8.1.0, < 8.1.4.1.
2. Update the Gemfile to require rails >= 8.0.5.2 (for 8.0.x) or >= 8.1.4.1 (for 8.1.x) and run 'bundle update rails'.
3. Search the codebase for non-HTML uses of strip_tags (such as inside .text.erb templates, mailers, or JSON serializers) and apply CGI.unescapeHTML where literal quotes are expected.
4. Run the application test suite and deploy the updated dependencies to production.

References

• GitHub Security Advisory: GHSA-rq8q-p985-fjq7
• Fix Commit 568b19cb860322885593e308a7f27aceb779e9d7
• Backport Commit c3772a10f405f9644125cbb484adfd2aa7a25a59
• Ruby on Rails Release v8.0.5.2
• Ruby on Rails Release v8.1.4.1
• NVD - CVE-2026-126070
• CVE.org Record - CVE-2026-126070

Read the full report for CVE-2026-126070 on our website for more details including interactive diagrams and full exploit analysis.