Rails heeft mogelijk een XSS-kwetsbaarheid in zijn Action Pack debug exceptions

The primary impact of CVE-2026-33167 is the potential for cross-site scripting (XSS) within the Rails application's debug exceptions page. An attacker who can trigger an exception with a specially crafted message can inject arbitrary HTML and JavaScript code. This code will then be executed in the context of the user's browser when they view the exception page. This could allow an attacker to steal session cookies, redirect users to malicious websites, or deface the application. The vulnerability's scope is limited to development environments where detailed exception pages are enabled, which is the default configuration. Exploitation requires the ability to trigger an exception, which might be achieved through input manipulation or by exploiting other vulnerabilities within the application.

Development teams using Ruby on Rails versions 8.1.2 and earlier are at risk. Specifically, applications configured with detailed exception pages enabled in development environments are particularly vulnerable. This includes developers working on new Rails projects or maintaining existing ones.

• ruby / server:

grep -r "config.consider_all_requests_local = true" config/environments/*.rb

• ruby / application code:

grep -r "exception_app.html.erb" app/views/exceptions/

1. 2026-03-23Disclosure

   disclosure

2. 2026-03-23Patch

   patch

1. Gereserveerd2026-03-17
2. Gepubliceerd2026-03-23
3. Gewijzigd2026-03-25
4. EPSS bijgewerkt2026-03-31

The primary mitigation for CVE-2026-33167 is to upgrade to Ruby on Rails Actionpack version 8.1.2.1 or later, which contains the fix. If upgrading is not immediately feasible, consider disabling detailed exception pages in development environments by setting config.considerallrequests_local = false in your Rails application configuration. This will prevent the vulnerable exception page from being displayed. As a temporary workaround, you could implement input validation and sanitization to prevent the injection of malicious characters into exception messages, although this is not a complete solution. After upgrading, confirm the fix by attempting to trigger an exception with a crafted message and verifying that the output is properly escaped.