CVE-2026-126078: Cross-Site Scripting in Ruby on Rails Action View highlight Helper

Vulnerability ID: CVE-2026-126078
CVSS Score: 6.1
Published: 2026-11-12

CVE-2026-126078 is a Cross-Site Scripting (XSS) vulnerability classified under CWE-79 affecting the Action View component of Ruby on Rails in versions prior to 8.0.5.2 and 8.1.4.1. The vulnerability resides in the ActionView::Helpers::TextHelper#highlight method when invoked with a custom :highlighter template that places capture group placeholders inside HTML attribute values. Because matched substrings are substituted without HTML escaping after initial sanitization preserves literal quotation marks, an attacker controlling the input text or target search phrase can break out of the surrounding attribute delimiter and inject arbitrary HTML attributes or JavaScript event handlers.

TL;DR

An improper input neutralization flaw (CWE-79) in Ruby on Rails Action View (< 8.0.5.2, < 8.1.4.1) allows Cross-Site Scripting (XSS) when using the highlight view helper with custom :highlighter strings containing placeholders inside HTML attributes.

⚠️ Exploit Status: POC

Technical Details

• CVE ID: CVE-2026-126078
• Advisory ID: GHSA-v6rj-xm57-3p59
• CWE Classification: CWE-79 (Cross-Site Scripting)
• CVSS v3.1 Score: 6.1 Medium (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
• EPSS Score: 0.34% (27.57th Percentile)
• Affected Component: ActionView::Helpers::TextHelper#highlight
• Patched Versions: Rails 8.0.5.2, Rails 8.1.4.1
• CISA KEV Status: Not Listed

Affected Systems

• Ruby on Rails (rails gem)
• Action View (actionview gem)
• actionview / rails: >= 8.0.0.beta1, < 8.0.5.2 (Fixed in: 8.0.5.2)
• actionview / rails: >= 8.1.0, < 8.1.4.1 (Fixed in: 8.1.4.1)

Code Analysis

Commit: 0693819

Escape the phrase substituted into highlight's :highlighter GHSA-v6rj-xm57-3p59

@@ -179,14 +186,23 @@ def highlight(text, phrases, options = {}, &block)
         else
           patterns = Array(phrases).map { |phrase| Regexp === phrase ? phrase : Regexp.escape(phrase) }
           pattern = /(#{patterns.join("|")})/i
+          pattern_after_tag = /(?!\A)#{pattern}/
           highlighter = options.fetch(:highlighter, '<mark>\1</mark>') unless block

-          text.scan(/<[^>]*|[^<]+/).each do |segment|
+          text.scan(/<[^>]*|[^<]+/).each_with_index do |segment, index|
             if !segment.start_with?("<")
+              segment_pattern = index > 0 ? pattern_after_tag : pattern
+
               if block
-                segment.gsub!(pattern, &block)
+                segment.gsub!(segment_pattern, &block)
               else
-                segment.gsub!(pattern, highlighter)
+                segment.gsub!(segment_pattern) do
+                  match = Regexp.last_match
+                  highlighter.gsub(/\\(\d)/) { ERB::Util.html_escape_once(match[$1.to_i]) }
+                end
               end
             end
           end.join

Commit: c796f61

Escape the phrase substituted into highlight's :highlighter GHSA-v6rj-xm57-3p59

Mitigation Strategies

• Upgrade Ruby on Rails and the actionview gem to patched versions 8.0.5.2 or 8.1.4.1.
• Refactor calls to ActionView::Helpers::TextHelper#highlight to use the block form alongside standard Rails helpers like link_to or tag.mark instead of passing a custom :highlighter template string.
• Audit application views for custom :highlighter strings that place backreference placeholders (\0 through \9) inside HTML attributes or URLs.
• Implement a strict Content Security Policy (CSP) that disallows inline script execution (unsafe-inline) to reduce the impact of injected HTML event handlers.

Remediation Steps:

1. Search the codebase for all occurrences of the highlight view helper using custom :highlighter options (e.g., grep -rn "highlighter:" app/).
2. Update the Gemfile to require rails >= 8.0.5.2 (for 8.0.x) or rails >= 8.1.4.1 (for 8.1.x).
3. Run bundle update rails actionview and verify the updated versions in Gemfile.lock.
4. Replace any :highlighter strings that embed \1 inside href or src attributes with the block form of highlight using link_to and route helpers.
5. Run the application test suite and redeploy the updated bundle to production environments.

References

• GitHub Security Advisory GHSA-v6rj-xm57-3p59
• Official CVE.org Record for CVE-2026-126078
• NVD Vulnerability Detail: CVE-2026-126078
• Rails Fix Commit (8.1 / main branch) - 06938194b4fd59e1d2c8ab4a781f3c1e2b763425
• Rails Fix Commit (8.0 branch) - c796f6198837479ada13290eb8fa767b5219a58a
• Ruby on Rails Release v8.0.5.2
• Ruby on Rails Release v8.1.4.1
• CVEProject cvelistV5 Record for CVE-2026-126078

Read the full report for CVE-2026-126078 on our website for more details including interactive diagrams and full exploit analysis.