UBUNTU-CVE-2026-126075: XSS
Active Support is a collection of utility classes and standard library extensions used by Rails and other Ruby projects. From 8.1 until 8.1.4.1, ActiveSupport::MessagePack serializes an ActiveSupport::SafeBuffer as its bytes alone and deserializes it as a new SafeBuffer, so a buffer that is no longer htmlsafe? (for example, one mutated in place with gsub!) is restored as htmlsafe. If such a buffer holds untrusted input and is stored through a MessagePack serializer, rendering it after it is loaded bypasses ERB auto-escaping, possibly leading to XSS. Applications on Rails 8.1 are affected if they use a MessagePack serializer, such as config.actiondispatch.cookiesserializer = :messagepack or :messagepackallowmarshal, or serializer: :messagepack for Rails.cache, ActiveSupport::MessageVerifier or ActiveSupport::MessageEncryptor, and store a SafeBuffer that was mutated in place with untrusted input. Rails 8.0 and earlier do not serialize SafeBuffer with MessagePack and are not affected. This issue is fixed in version 8.1.4.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Railsto a version that resolves this vulnerability.Fixed in 8.1.4.1
Event History
Frequently Asked Questions
Which Rails versions need to be triaged?
Rails 8.1 through 8.1.4.1 are affected. Rails 8.0 and earlier do not serialize SafeBuffer with MessagePack and are not affected.
What application conditions are required for exploitation?
The application must use a MessagePack serializer and store a SafeBuffer that was mutated in place with untrusted input, such as with gsub!. Exploitation occurs if the restored buffer is later rendered, because it is incorrectly treated as html_safe and bypasses ERB auto-escaping.
Where should teams look for MessagePack usage?
Check for config.action_dispatch.cookies_serializer set to :message_pack or :message_pack_allow_marshal. Also check Rails.cache, ActiveSupport::MessageVerifier, and ActiveSupport::MessageEncryptor for serializer: :message_pack.
What version contains the fix?
The issue is fixed in Rails 8.1.4.1.