CVE-2026-33170
Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework.
Published Mar 24, 2026 · updated Jun 17, 2026 · rubyonrails rails
Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, does not propagate the flag to the newly created buffer. If a is mutated in place (e.g. via ) and then formatted with using untrusted arguments, the result incorrectly reports , bypassing ERB auto-escaping and possibly leading to XSS. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Mar 24, 2026 · NIST NVD
Detected
Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, does not propagate the flag to the newly created buffer. If a is mutated in place (e.g. via ) and then formatted with using untrusted arguments, the result incorrectly reports , bypassing ERB auto-escaping and possibly leading to XSS. Versio
Jun 17, 2026 · NIST NVD
Updated
Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, does not propagate the flag to the newly created buffer. If a is mutated in place (e.g. via ) and then formatted with using untrusted arguments, the result incorrectly reports , bypassing ERB auto-escaping and possibly leading to XSS. Versio
Affected
- cpe rubyonrails/railsversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-33170
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-33170
Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, does not propagate the flag to the newly created buffer. If a is mutated in pl
nvd.nist.gov