CVE-2026-33167: XSS in Ruby on Rails Actionpack

The primary impact of CVE-2026-33167 is the potential for cross-site scripting (XSS) within the Rails application's debug exceptions page. An attacker who can trigger an exception with a specially crafted message can inject arbitrary HTML and JavaScript code. This code will then be executed in the context of the user's browser when they view the exception page. This could allow an attacker to steal session cookies, redirect users to malicious websites, or deface the application. The vulnerability's scope is limited to development environments where detailed exception pages are enabled, which is the default configuration. Exploitation requires the ability to trigger an exception, which might be achieved through input manipulation or by exploiting other vulnerabilities within the application.

1. Reserved2026-03-17
2. Published2026-03-23
3. Modified2026-03-25
4. EPSS updated2026-03-31

The primary mitigation for CVE-2026-33167 is to upgrade to Ruby on Rails Actionpack version 8.1.2.1 or later, which contains the fix. If upgrading is not immediately feasible, consider disabling detailed exception pages in development environments by setting config.considerallrequests_local = false in your Rails application configuration. This will prevent the vulnerable exception page from being displayed. As a temporary workaround, you could implement input validation and sanitization to prevent the injection of malicious characters into exception messages, although this is not a complete solution. After upgrading, confirm the fix by attempting to trigger an exception with a crafted message and verifying that the output is properly escaped.