Action View: Possible XSS vulnerability in highlight helper
CVE-2026-126078
Impact ActionView::Helpers::TextHelper#highlight substitutes each matched phrase into the :highlighter string without escaping it and returns the result marked HTML-safe. Because sanitizing leaves quote characters in text unescaped, a match substituted into a quoted attribute value of the highlighter, such as the form shown in the method's documentation, could end the attribute value and add attributes to the element, possibly leading to XSS. Applications are affected when they pass a :highlighter that places a placeholder inside an attribute value and highlight text or phrases that a user controls. The default \1 highlighter and the block form are not affected. Details The fixed releases HTML-escape each group substituted into the :highlighter string, so quotes in a match are rendered as " and '. Only the numbered placeholders \0 to \9 are expanded; other String#sub replacement escapes, such as \k , \& and \\, are left as written. A match can no longer begin on the > that closes a preceding tag. Escaping makes a placeholder safe as element content or inside a quoted attribute value, but not in an unquoted attribute value, a URL, JavaScript or CSS context, or an attribute whose…
Assessment
- CVSS
- 6.1 (v3.1)
- Severity
- Medium
- EPSS
- 0.00338% chance of exploitation in the next 30 days
- Known exploited
- Not listed in CISA KEV
- Exploit availability
- Nothing found in Exploit-DB, Metasploit, Nuclei or public PoC repositories
- Published
- 12 November 2026
- Last updated
- 12 November 2026
- Affected
- actionview
- Weakness
- CWE-79
CVSS vectorCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
At the source
References
- https://github.com/rails/rails/security/advisories/GHSA-v6rj-xm57-3p59
- https://nvd.nist.gov/vuln/detail/CVE-2026-126078
- https://github.com/rails/rails/commit/06938194b4fd59e1d2c8ab4a781f3c1e2b763425
- https://github.com/rails/rails/commit/c796f6198837479ada13290eb8fa767b5219a58a
- https://github.com/rails/rails/releases/tag/v8.0.5.2
- https://github.com/rails/rails/releases/tag/v8.1.4.1
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionview/GHSA-v6rj-xm57-3p59.yml
- https://github.com/advisories/GHSA-v6rj-xm57-3p59
Community proofs of concept
No community proof of concept yet. If you have one for a published vulnerability and the right to share it, add it below — it will appear here once reviewed.
Submit a proof of concept
Only for publicly disclosed vulnerabilities, and only material from testing you were authorised to perform. This platform does not buy, sell, or broker exploits — see earning from vulnerability research for legitimate bounty programs. Submissions are reviewed before they appear. Text only; do not include live credentials, personal data, or anything targeting systems you are not permitted to test.
Query this programmatically
Agents can read this through the MCP endpoint, or over HTTP:
curl https://cve.zerocrew.in/api/cve/CVE-2026-126078