UBUNTU-CVE-2026-126070: XSS
Action View is a framework for handling view template lookup and rendering and provides view helpers for building HTML. Prior to 8.1.4.1 and 8.0.5.2, striptags in Action View returns its sanitized output marked htmlsafe, but the underlying sanitizer encodes only &, < and >, leaving " and ' unencoded. Because ERB does not escape a string marked htmlsafe, untrusted input passed through striptags and rendered inside a quoted HTML attribute value could close the attribute and add new attributes, possibly leading to XSS. Applications that render striptags output from untrusted input inside an HTML attribute, for example in a title attribute or a <meta content> tag, are affected. Output rendered as element content is not affected. This issue is fixed in versions 8.1.4.1 and 8.0.5.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Action Viewto a version that resolves this vulnerability.Fixed in 8.1.4.1 - Upgrade
Upgrade
Action Viewto a version that resolves this vulnerability.Fixed in 8.0.5.2
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications are affected when they pass untrusted input through Action View's strip_tags and render the result in a quoted HTML attribute, such as a title attribute or a meta content tag. Rendering the output as element content is not affected.
What does an attacker need to exploit it?
An attacker needs to control input that the application processes with strip_tags and then inserts into a quoted HTML attribute. Unencoded double or single quotes can close the attribute and inject additional attributes, potentially resulting in cross-site scripting.
Which versions contain the fix?
The issue is fixed in Action View versions 8.1.4.1 and 8.0.5.2. Versions prior to those releases are affected in the described usage pattern.