{"id":"CVE-2026-126069","aliases":["GHSA-68p9-83h6-5wpj"],"url":"https://o3.security/vulnerability/CVE-2026-126069","summary":"Action View: Possible XSS vulnerability in Action View tag helpers","details":"### Impact\nThe fix for [CVE-2026-33168](https://github.com/rails/rails/security/advisories/GHSA-v55j-83pf-r9cq) skips blank HTML attribute names in Action View tag helpers, but it tests the name before converting it to a string. A Symbol name made only of whitespace, such as `:\" \"`, is not blank, because `Symbol#blank?` is `Symbol#empty?`, so it reaches the attribute escaping, which emits an attribute with no name and produces malformed HTML. The asset tag helpers, such as `image_tag`, `video_tag` and `audio_tag`, symbolize their options, so a whitespace String name passed to them takes the same path. A carefully crafted attribute value could then be misinterpreted by the browser as a separate attribute name, possibly leading to XSS. Applications that allow users to specify custom HTML attribute names are affected.\n\n### Releases\nThe fixed releases are available at the normal locations.\n\nPatches for those who cannot upgrade at once:\n- 8.1: https://github.com/rails/rails/commit/9190210606ffe52f92fdc75637f8ff69404f22c8.patch\n- 8.0: https://github.com/rails/rails/commit/f47452533e1f28d847c63181b9d5f8b7243ef9a4.patch\n\n### Credit\nThis issue was responsibly reported by HackerOne researcher [thepo1es](https://hackerone.com/thepo1es).","published":"2026-11-10T20:36:59.705Z","modified":"2026-11-12T02:48:31.886767181Z","cvss":{"score":4.7,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"RubyGems","name":"actionview","fixedVersion":"8.1.4.1"},{"ecosystem":"RubyGems","name":"actionview","fixedVersion":"8.0.5.2"}],"fix":{"url":"https://github.com/rails/rails/commit/9190210606ffe52f92fdc75637f8ff69404f22c8","label":"rails/rails@9190210"},"references":[{"type":"WEB","url":"https://github.com/rails/rails/releases/tag/v8.0.5.2"},{"type":"WEB","url":"https://github.com/rails/rails/releases/tag/v8.1.4.1"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/126xxx/CVE-2026-126069.json"},{"type":"ADVISORY","url":"https://github.com/rails/rails/security/advisories/GHSA-68p9-83h6-5wpj"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126069"},{"type":"FIX","url":"https://github.com/rails/rails/commit/9190210606ffe52f92fdc75637f8ff69404f22c8"},{"type":"FIX","url":"https://github.com/rails/rails/commit/f47452533e1f28d847c63181b9d5f8b7243ef9a4"},{"type":"PACKAGE","url":"https://github.com/rails/rails"},{"type":"WEB","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionview/GHSA-68p9-83h6-5wpj.yml"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-11-12T02:48:31.886767181Z"}}