{"id":"CVE-2026-126078","aliases":["GHSA-v6rj-xm57-3p59"],"url":"https://o3.security/vulnerability/CVE-2026-126078","summary":"Action View: Possible XSS vulnerability in Action View highlight helper","details":"### Impact\n`ActionView::Helpers::TextHelper#highlight` substitutes each matched phrase into the `:highlighter` string without escaping it and returns the result marked HTML-safe. Because sanitizing leaves quote characters in text unescaped, a match substituted into a quoted attribute value of the highlighter, such as the `<a href=\"search?q=\\1\">` form shown in the method's documentation, could end the attribute value and add attributes to the element, possibly leading to XSS. Applications are affected when they pass a `:highlighter` that places a placeholder inside an attribute value and highlight text or phrases that a user controls. The default `<mark>\\1</mark>` highlighter and the block form are not affected.\n\n### Details\nThe fixed releases HTML-escape each group substituted into the `:highlighter` string, so quotes in a match are rendered as `&quot;` and `&#39;`. Only the numbered placeholders `\\0` to `\\9` are expanded; other `String#sub` replacement escapes, such as `\\k<name>`, `\\&` and `\\\\`, are left as written. A match can no longer begin on the `>` that closes a preceding tag. Escaping makes a placeholder safe as element content or inside a quoted attribute value, but not in an unquoted attribute value, a URL, JavaScript or CSS context, or an attribute whose value is HTML. See the Action View CHANGELOG for details.\n\n### Workarounds\nUse a `:highlighter` that places the matched phrase only in element content, such as the default `<mark>\\1</mark>`.\n\n### Releases\nThe fixed releases are available at the normal locations.\n\nPatches for those who cannot upgrade at once:\n- 8.1: https://github.com/rails/rails/commit/06938194b4fd59e1d2c8ab4a781f3c1e2b763425.patch\n- 8.0: https://github.com/rails/rails/commit/c796f6198837479ada13290eb8fa767b5219a58a.patch\n\n### Credit\nThis issue was found by the Anthropic OSS Scanner (ANT-2026-THHUJQVO).","published":"2026-11-10T21:00:49.416Z","modified":"2026-11-14T02:30:55.706685133Z","cvss":{"score":6.1,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"RubyGems","name":"actionview","fixedVersion":"8.1.4.1"},{"ecosystem":"RubyGems","name":"actionview","fixedVersion":"8.0.5.2"}],"fix":{"url":"https://github.com/rails/rails/commit/06938194b4fd59e1d2c8ab4a781f3c1e2b763425","label":"rails/rails@0693819"},"references":[{"type":"WEB","url":"https://github.com/rails/rails/releases/tag/v8.0.5.2"},{"type":"WEB","url":"https://github.com/rails/rails/releases/tag/v8.1.4.1"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/126xxx/CVE-2026-126078.json"},{"type":"ADVISORY","url":"https://github.com/rails/rails/security/advisories/GHSA-v6rj-xm57-3p59"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126078"},{"type":"FIX","url":"https://github.com/rails/rails/commit/06938194b4fd59e1d2c8ab4a781f3c1e2b763425"},{"type":"FIX","url":"https://github.com/rails/rails/commit/c796f6198837479ada13290eb8fa767b5219a58a"},{"type":"PACKAGE","url":"https://github.com/rails/rails"},{"type":"WEB","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionview/GHSA-v6rj-xm57-3p59.yml"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-11-14T02:30:55.706685133Z"}}