Platform
ruby
Component
actionview
Fixed in
8.1.1
8.0.1
7.2.4
8.1.2.1
CVE-2026-33168 describes a cross-site scripting (XSS) vulnerability within the Action View component of Ruby on Rails. This flaw arises when a blank string is utilized as an HTML attribute name, effectively bypassing the attribute escaping mechanism. Consequently, a carefully crafted attribute value can be misinterpreted by the browser, potentially leading to XSS attacks. Affected versions include those prior to 8.1.2.1, with a fix now available.
The core of this vulnerability lies in the improper handling of blank strings within HTML attribute names. When an attacker can inject a blank string as an attribute name, the escaping process is bypassed. This allows them to inject arbitrary HTML and JavaScript into the page, which will then be executed in the context of the user's browser. The impact is significant for applications that allow users to define custom HTML attributes, as these are the most susceptible to exploitation. An attacker could leverage this to steal user credentials, deface the website, or redirect users to malicious sites. The potential for session hijacking and other malicious activities is high.
This vulnerability was responsibly disclosed by Hackerone researcher [taise] and published on 2026-03-23. There are currently no publicly available proof-of-concept exploits, but the potential for exploitation exists, particularly in applications with custom HTML attribute handling. The CVSS score of 2.5 (LOW) indicates a relatively low probability of exploitation, but the potential impact warrants prompt remediation.
Exploit Status
EPSS
0.02% (6% percentile)
CISA SSVC
The primary mitigation for CVE-2026-33168 is to upgrade to Ruby on Rails version 8.1.2.1 or later. This version includes a fix that properly handles blank strings in HTML attribute names, preventing the bypass of escaping. If upgrading immediately is not feasible, consider implementing input validation on the server-side to sanitize user-provided HTML attributes. While not a complete solution, this can reduce the attack surface. Additionally, employing a Web Application Firewall (WAF) with rules to detect and block suspicious HTML attribute injection attempts can provide an additional layer of defense. After upgrading, confirm the fix by attempting to inject a blank string as an attribute name and verifying that the attribute is properly escaped.
Update Rails to version 8.1.2.1, 8.0.4.1, or 7.2.3.1, or higher, as appropriate for your version branch. This corrects the XSS vulnerability in Action View.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2026-33168 is a cross-site scripting (XSS) vulnerability in Ruby on Rails Action View, affecting versions up to 8.1.2. It allows attackers to bypass attribute escaping by using blank strings in HTML attributes.
You are affected if you are using Ruby on Rails versions 8.1.2 or earlier and your application allows users to specify custom HTML attributes.
Upgrade to Ruby on Rails version 8.1.2.1 or later to remediate the vulnerability. Implement input validation as a temporary workaround if immediate upgrade is not possible.
Currently, there are no publicly known active exploits, but the potential for exploitation exists, especially in vulnerable applications.
Refer to the official Ruby on Rails security advisories for detailed information and updates: [https://github.com/rails/rails/security/advisories](https://github.com/rails/rails/security/advisories)
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Upload your Gemfile.lock file and we'll tell you instantly if you're affected.