CVE-2026-33170 Rails Active Support has a possible XSS vulnerability in SafeBuffer#%
Attackers can inject malicious scripts via SafeBuffer formatting, bypassing auto-escaping and leading to XSS in Rails applications.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-33170?
CVE-2026-33170 is a medium-severity cross-site scripting vulnerability in Rubyonrails Rails, published on 23 Mar 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, `SafeBuffer#%` does not propagate the `@html_unsafe` flag to the newly created buffer. If a `SafeBuffer` is mutated in place (e.g. via `gsub!`) and then formatted with `%` using untrusted arguments, the result incorrectly reports `html_safe? == true`, bypassing ERB auto-escaping and possibly leading to XSS. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
Weakness: CWE-79
Which versions are affected by CVE-2026-33170?
6 open source packages ship an affected version, including activesupport. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
activesupport RubyGems | All versions | 7.2.3.1 |
activesupport RubyGems | All versions | 7.2.3.1 |
activesupport RubyGems | From 8.0.0.beta1 | 8.0.4.1 |
activesupport RubyGems | From 8.0.0.beta1 | 8.0.4.1 |
activesupport RubyGems | From 8.1.0.beta1 | 8.1.2.1 |
activesupport RubyGems | From 8.1.0.beta1 | 8.1.2.1 |
Products include Rubyonrails Rails.
How do I fix CVE-2026-33170?
Upgrade activesupport to a fixed version for your release line: 7.2.3.1, 8.0.4.1 or 8.1.2.1.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-33170 being exploited?
There is no known exploitation of CVE-2026-33170 in the wild and no public exploit code.
Other vulnerabilities in Rubyonrails Rails
- CVE-2013-0277 Active Record contains deserialization of arbitrary YAML
- CVE-2017-17916 SQL injection in n/a
- CVE-2017-17917 SQL injection in n/a
- CVE-2026-33195 Rails Active Storage has possible Path Traversal in DiskService
- CVE-2024-26142 Rails possible ReDoS vulnerability in Accept header parsing in Action Dispatch
Sources
Also known as DEBIAN-CVE-2026-33170, GHSA-89vf-4333-qx8v, MINI-9vj3-xj58-j29g, MINI-pxrv-47vx-xg3p, MINI-r9x8-q49h-x8mq, UBUNTU-CVE-2026-33170.