CVE-2026-33167: Rails has a possible XSS vulnerability in its Action Pack debug exceptions
Impact The debug exceptions page does not properly escape exception messages. A carefully crafted exception message could inject arbitrary HTML and JavaScript into the page, leading to XSS. This affects applications with detailed exception pages enabled (config.considerallrequestslocal = true), which is the default in development.
Releases The fixed releases are available at the normal locations.
Other sources
Action Pack is a Rubygem for building web applications on the Rails framework. In versions on the 8.1 branch prior to 8.1.2.1, the debug exceptions page does not properly escape exception messages. A carefully crafted exception message could inject arbitrary HTML and JavaScript into the page, leading to XSS. This affects applications with detailed exception pages enabled (config.considerallrequestslocal = true), which is the default in development. Version 8.1.2.1 contains a patch.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rubygems/actionpackto a version that resolves this vulnerability.Fixed in 8.1.2.1 - Upgrade
Upgrade
rails/actionpackto a version that resolves this vulnerability.Fixed in 8.1.2.1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33167?
CVE-2026-33167 is a moderate severity vulnerability due to its potential for XSS attacks.
How do I fix CVE-2026-33167?
To fix CVE-2026-33167, upgrade to actionpack version 8.1.2.1 or later.
What type of vulnerability is CVE-2026-33167?
CVE-2026-33167 is classified as a Cross-Site Scripting (XSS) vulnerability.
Which software is affected by CVE-2026-33167?
CVE-2026-33167 affects applications using the actionpack version between 8.1.0 and 8.1.2.1 with detailed exception pages enabled.
Can CVE-2026-33167 lead to data theft?
Yes, if exploited, CVE-2026-33167 can lead to data theft through the execution of arbitrary JavaScript.