プラットフォーム
ruby
コンポーネント
actionview
修正版
8.1.1
8.0.1
7.2.4
8.1.2.1
CVE-2026-33168 describes a cross-site scripting (XSS) vulnerability within the Action View component of Ruby on Rails. This flaw arises when a blank string is utilized as an HTML attribute name, effectively bypassing the attribute escaping mechanism. Consequently, a carefully crafted attribute value can be misinterpreted by the browser, potentially leading to XSS attacks. Affected versions include those prior to 8.1.2.1, with a fix now available.
The core of this vulnerability lies in the improper handling of blank strings within HTML attribute names. When an attacker can inject a blank string as an attribute name, the escaping process is bypassed. This allows them to inject arbitrary HTML and JavaScript into the page, which will then be executed in the context of the user's browser. The impact is significant for applications that allow users to define custom HTML attributes, as these are the most susceptible to exploitation. An attacker could leverage this to steal user credentials, deface the website, or redirect users to malicious sites. The potential for session hijacking and other malicious activities is high.
This vulnerability was responsibly disclosed by Hackerone researcher [taise] and published on 2026-03-23. There are currently no publicly available proof-of-concept exploits, but the potential for exploitation exists, particularly in applications with custom HTML attribute handling. The CVSS score of 2.5 (LOW) indicates a relatively low probability of exploitation, but the potential impact warrants prompt remediation.
Applications built with Ruby on Rails that allow users to specify custom HTML attributes are particularly at risk. This includes web applications that utilize rich text editors, form builders, or any other component that allows users to define HTML content. Legacy Rails applications running older, unpatched versions are also a significant concern.
• ruby / server:
# Check for vulnerable versions
ruby -v• ruby / server:
gem list actionview | grep '8.1.2' # Check if Action View version is vulnerable• ruby / server:
# Review application code for instances where user-provided data is used directly in HTML attributes without proper sanitization.disclosure
エクスプロイト状況
EPSS
0.02% (6% パーセンタイル)
CISA SSVC
The primary mitigation for CVE-2026-33168 is to upgrade to Ruby on Rails version 8.1.2.1 or later. This version includes a fix that properly handles blank strings in HTML attribute names, preventing the bypass of escaping. If upgrading immediately is not feasible, consider implementing input validation on the server-side to sanitize user-provided HTML attributes. While not a complete solution, this can reduce the attack surface. Additionally, employing a Web Application Firewall (WAF) with rules to detect and block suspicious HTML attribute injection attempts can provide an additional layer of defense. After upgrading, confirm the fix by attempting to inject a blank string as an attribute name and verifying that the attribute is properly escaped.
Railsをバージョン8.1.2.1、8.0.4.1、または7.2.3.1、またはそれ以上のバージョンにアップデートしてください。これにより、Action ViewにおけるXSS脆弱性が修正されます。
脆弱性分析と重要アラートをメールでお届けします。
CVE-2026-33168 is a cross-site scripting (XSS) vulnerability in Ruby on Rails Action View, affecting versions up to 8.1.2. It allows attackers to bypass attribute escaping by using blank strings in HTML attributes.
You are affected if you are using Ruby on Rails versions 8.1.2 or earlier and your application allows users to specify custom HTML attributes.
Upgrade to Ruby on Rails version 8.1.2.1 or later to remediate the vulnerability. Implement input validation as a temporary workaround if immediate upgrade is not possible.
Currently, there are no publicly known active exploits, but the potential for exploitation exists, especially in vulnerable applications.
Refer to the official Ruby on Rails security advisories for detailed information and updates: [https://github.com/rails/rails/security/advisories](https://github.com/rails/rails/security/advisories)
依存関係ファイルをアップロードすれば、このCVEや他のCVEがあなたに影響するか即座にわかります。
Gemfile.lock ファイルをアップロードすると、影響の有無を即座にお知らせします。