CVE-2026-126079: Cross-Site Scripting in Ruby on Rails Action View Text Helpers via HTML5 Serialization Desynchronization

Vulnerability ID: CVE-2026-126079
CVSS Score: 6.1
Published: 2026-11-12

A Cross-Site Scripting (XSS) vulnerability exists in Ruby on Rails Action View prior to versions 8.0.5.2 and 8.1.4.1. When applications use the default HTML5 sanitizer (Rails::HTML5::Sanitizer) with Nokogiri versions prior to 1.19.5, angle brackets (< and >) inside HTML attribute values are serialized unescaped. Action View text helpers—specifically highlight and simple_format—perform string-based manipulations on the sanitized HTML rather than operating on the DOM tree. An unescaped '>' character or a double newline ('\n\n') inside an attribute value causes these helpers to misidentify tag or paragraph boundaries, breaking out of the attribute context and emitting inert attribute contents as live HTML elements in the final html_safe output.

TL;DR

Action View's highlight and simple_format helpers perform regex and string splitting on HTML sanitized by Rails::HTML5::Sanitizer. Because Nokogiri < 1.19.5 leaves '<' and '>' unescaped inside HTML5 attribute values, attackers can inject crafted attributes that break during string post-processing, resulting in Cross-Site Scripting (XSS). Upgrade to Rails 8.0.5.2 or 8.1.4.1 and Nokogiri >= 1.19.5.

⚠️ Exploit Status: POC

Technical Details

• Vulnerability Type: Cross-Site Scripting (CWE-79)
• Affected Component: Action View (highlight & simple_format helpers)
• CVSS v3.1 Score: 6.1 Medium (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
• EPSS Score: 0.34% (27.57th percentile)
• Root Cause: Unescaped < and > in HTML5 attribute serialization combined with string-based helper post-processing
• Patched Versions: Rails 8.0.5.2 / 8.1.4.1 (Nokogiri >= 1.19.5)
• Exploit Status: Proof-of-Concept (Regression Test Vectors)
• CISA KEV Status: Not Listed

Affected Systems

• Ruby on Rails (actionview)
• rails-html-sanitizer
• loofah
• nokogiri
• Ruby on Rails (actionview): < 8.0.5.2 (Fixed in: 8.0.5.2)
• Ruby on Rails (actionview): >= 8.1.0, < 8.1.4.1 (Fixed in: 8.1.4.1)
• rails-html-sanitizer: < 1.7.2 (Fixed in: 1.7.2)
• loofah: < 2.25.3 (Fixed in: 2.25.3)
• nokogiri: < 1.19.5 (Fixed in: 1.19.5)

Code Analysis

Commit: adc3a32

Require rails-html-sanitizer 1.7.2 or later GHSA-2p2f-4rq4-gjwc

File: actionview/actionview.gemspec
@@ -37,7 +37,7 @@ Gem::Specification.new do |s|

   s.add_dependency "builder",       "~> 3.1"
   s.add_dependency "erubi",         "~> 1.11"
-  s.add_dependency "rails-html-sanitizer", "~> 1.6"
+  s.add_dependency "rails-html-sanitizer", "~> 1.6", ">= 1.7.2"
   s.add_dependency "rails-dom-testing", "~> 2.2"

   s.add_development_dependency "actionpack",  version

File: actionview/test/template/text_helper_test.rb
@@ -564,3 +564,21 @@ def test_cycle_no_instance_variable_clashes
     assert_equal(%w{Specialized Fuji Giant}, @cycles)
   end
 end
+
+class TextHelperHTML5SanitizerTest < ActionView::TestCase
+  tests ActionView::Helpers::TextHelper
+
+  self.safe_list_sanitizer = Rails::HTML5::SafeListSanitizer.new
+
+  def test_highlight_keeps_markup_inside_attribute_values_inert
+    html = highlight(%(<a title="x > y" class="<img src=x onerror=alert(1)>">z</a>), "class")
+
+    assert_empty Nokogiri::HTML5.fragment(html).css("img")
+  end
+
+  def test_simple_format_keeps_markup_inside_attribute_values_inert
+    html = simple_format(%(<a title="x\n\n<img src=x onerror=alert(1)>">link</a>), class: "post")
+
+    assert_empty Nokogiri::HTML5.fragment(html).css("img")
+  end
+end if Rails::HTML::Sanitizer.html5_support?

Commit: 009ea68

Require rails-html-sanitizer 1.7.2 or later GHSA-2p2f-4rq4-gjwc

Mitigation Strategies

• Upgrade Ruby on Rails (Action View) and the underlying HTML sanitization gem dependencies (rails-html-sanitizer, loofah, nokogiri) to enforce entity encoding of '<' and '>' within serialized HTML5 attribute values.
• Temporarily revert Action View's sanitizer vendor configuration to Rails::HTML4::Sanitizer if gem upgrades cannot be immediately applied.
• Strip all HTML tags or explicitly HTML-escape untrusted user inputs before passing them to string-manipulating view helpers like highlight and simple_format.

Remediation Steps:

1. Update your application's Gemfile to specify Rails >= 8.0.5.2 or >= 8.1.4.1.
2. Execute bundle update rails actionview rails-html-sanitizer loofah nokogiri to refresh the lockfile.
3. Verify in Gemfile.lock that nokogiri is at version 1.19.5 or higher, loofah is at 2.25.3 or higher, and rails-html-sanitizer is at 1.7.2 or higher.
4. Run bundle audit to confirm no vulnerable dependency versions remain in the lockfile.
5. Redeploy the application and execute the test suite to verify view rendering behavior.

References

• GitHub Security Advisory GHSA-2p2f-4rq4-gjwc
• NVD - CVE-2026-126079
• CVE.org Record - CVE-2026-126079
• Rails Fix Commit (8-1-stable) - adc3a32d4abea77ed3aacf6f5fb71cfc005bef73
• Rails Fix Commit (8-0-stable) - 009ea68342d05d02087c04dae7faaa4e4c1def11
• Rails v8.1.4.1 Release
• Rails v8.0.5.2 Release
• CVE List V5 Record - CVE-2026-126079
• Wiz Vulnerability Database - CVE-2026-126079
• Shodan CVEDB - CVE-2026-126079

Read the full report for CVE-2026-126079 on our website for more details including interactive diagrams and full exploit analysis.