CVE-2026-33170: Rails Active Support has a possible XSS vulnerability in SafeBuffer#%
Impact SafeBuffer#% does not propagate the @htmlunsafe flag to the newly created buffer. If a SafeBuffer is mutated in place (e.g. via gsub!) and then formatted with % using untrusted arguments, the result incorrectly reports htmlsafe? == true, bypassing ERB auto-escaping and possibly leading to XSS.
Releases The fixed releases are available at the normal locations.
Other sources
Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, SafeBuffer#% does not propagate the @htmlunsafe flag to the newly created buffer. If a SafeBuffer is mutated in place (e.g. via gsub!) and then formatted with % using untrusted arguments, the result incorrectly reports htmlsafe? == true, bypassing ERB auto-escaping and possibly leading to XSS. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33170?
CVE-2026-33170 has a moderate severity as it can lead to improper HTML escape handling in applications.
How do I fix CVE-2026-33170?
To fix CVE-2026-33170, update the activesupport package to versions 7.2.3.1, 8.0.4.1, or 8.1.2.1 or later.
What types of attacks can CVE-2026-33170 facilitate?
CVE-2026-33170 can facilitate XSS attacks by improperly handling untrusted input in HTML contexts.
Which versions of activesupport are affected by CVE-2026-33170?
Versions of activesupport prior to 7.2.3.1, 8.0.4.1, and 8.1.2.1 are affected by CVE-2026-33170.
What is the main issue caused by CVE-2026-33170?
The main issue caused by CVE-2026-33170 is the failure to propagate the @html_unsafe flag in SafeBuffer, allowing unsafe HTML generation.