CVE-2026-126075: Active Support: Possible XSS vulnerability in Active Support MessagePack serializer
Impact ActiveSupport::MessagePack serializes an ActiveSupport::SafeBuffer as its bytes alone and deserializes it as a new SafeBuffer, so a buffer that is no longer htmlsafe? (for example, one mutated in place with gsub!) is restored as htmlsafe. If such a buffer holds untrusted input and is stored through a MessagePack serializer, rendering it after it is loaded bypasses ERB auto-escaping, possibly leading to XSS.
Applications on Rails 8.1 are affected if they use a MessagePack serializer, such as config.actiondispatch.cookiesserializer = :messagepack or :messagepackallowmarshal, or serializer: :messagepack for Rails.cache, ActiveSupport::MessageVerifier or ActiveSupport::MessageEncryptor, and store a SafeBuffer that was mutated in place with untrusted input. Rails 8.0 and earlier do not serialize SafeBuffer with MessagePack and are not affected.
Details The fixed releases serialize a SafeBuffer that is not htmlsafe? with a marker and deserialize it as a String; a SafeBuffer that is htmlsafe? keeps the existing format. Versions without the fix cannot read an unsafe buffer serialized by the fixed releases, so during a rolling deploy a cookie or cache entry holding one could fail to load on a process that has not been upgraded.
Workarounds Applications that cannot upgrade can convert a SafeBuffer to a String with tostr before storing it in a value that a MessagePack serializer writes.
Releases The fixed releases are available at the normal locations.
Patches for those who cannot upgrade at once: - 8.1: https://github.com/rails/rails/commit/4ca090665976e6fbc471c38689b399f84b43cdc7.patch
Credit This issue was responsibly reported by HackerOne researcher jcwilk.
Other sources
Active Support is a collection of utility classes and standard library extensions used by Rails and other Ruby projects. From 8.1 until 8.1.4.1, ActiveSupport::MessagePack serializes an ActiveSupport::SafeBuffer as its bytes alone and deserializes it as a new SafeBuffer, so a buffer that is no longer htmlsafe? (for example, one mutated in place with gsub!) is restored as htmlsafe. If such a buffer holds untrusted input and is stored through a MessagePack serializer, rendering it after it is loaded bypasses ERB auto-escaping, possibly leading to XSS. Applications on Rails 8.1 are affected if they use a MessagePack serializer, such as config.actiondispatch.cookiesserializer = :messagepack or :messagepackallowmarshal, or serializer: :messagepack for Rails.cache, ActiveSupport::MessageVerifier or ActiveSupport::MessageEncryptor, and store a SafeBuffer that was mutated in place with untrusted input. Rails 8.0 and earlier do not serialize SafeBuffer with MessagePack and are not affected. This issue is fixed in version 8.1.4.1.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rubygems/activesupportto a version that resolves this vulnerability.Fixed in 8.1.4.1 - Upgrade
Upgrade
rails/railsto a version that resolves this vulnerability.Fixed in 8.1.4.1 - Compensating control
If unable to upgrade, convert a SafeBuffer to a String with to_str before storing it in a value written by a MessagePack serializer.
Event History
Frequently Asked Questions
Which applications are affected?
Affected applications run Rails 8.1, use a MessagePack serializer, and store an ActiveSupport::SafeBuffer that has been mutated in place with untrusted input. Rails 8.0 and earlier are not affected because they do not serialize SafeBuffer with MessagePack.
What conditions are needed for XSS exploitation?
Untrusted input must be placed into a SafeBuffer that is no longer html_safe?, such as through an in-place gsub!, then stored and later loaded through a MessagePack serializer. If the loaded buffer is rendered, ERB auto-escaping can be bypassed.
Where should MessagePack serializer usage be checked?
Check for config.action_dispatch.cookies_serializer set to :message_pack or :message_pack_allow_marshal. Also check Rails.cache, ActiveSupport::MessageVerifier, and ActiveSupport::MessageEncryptor for serializer: :message_pack.
What can be done before a fix is deployed?
Avoid storing SafeBuffer values that were mutated in place with untrusted input through a MessagePack serializer. Ensure untrusted content is handled as a String rather than relying on a SafeBuffer whose safety state may have changed.
Is there a rolling-deployment compatibility concern?
Versions without the fix cannot read an unsafe buffer serialized by fixed releases. Coordinate mixed-version deployments to avoid older instances attempting to deserialize those values.