UBUNTU-CVE-2026-126078: XSS
Action View is a framework for handling view template lookup and rendering and provides view helpers for building HTML. Prior to 8.1.4.1 and 8.0.5.2, ActionView::Helpers::TextHelper#highlight substitutes each matched phrase into the :highlighter string without escaping it and returns the result marked HTML-safe. Because sanitizing leaves quote characters in text unescaped, a match substituted into a quoted attribute value of the highlighter, such as the <a href="search?q=\1"> form shown in the method's documentation, could end the attribute value and add attributes to the element, possibly leading to XSS. Applications are affected when they pass a :highlighter that places a placeholder inside an attribute value and highlight text or phrases that a user controls. The default <mark>\1</mark> highlighter and the block form are not affected. This issue is fixed in versions 8.1.4.1 and 8.0.5.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ActionViewto a version that resolves this vulnerability.Fixed in 8.1.4.1 - Upgrade
Upgrade
ActionViewto a version that resolves this vulnerability.Fixed in 8.0.5.2
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications are affected only if they use ActionView::Helpers::TextHelper#highlight with a custom :highlighter that places a placeholder inside an HTML attribute value, and the highlighted text or phrases can be controlled by a user.
Are default uses of highlight affected?
No. The default <mark>\1</mark> highlighter is not affected, and the block form of highlight is also not affected.
What does an attacker need to exploit this?
An attacker needs control over text or phrases supplied to highlight and must be able to cause a match that is substituted into a placeholder located within a quoted attribute value in a custom :highlighter. This can allow the attacker to terminate the attribute value and inject additional attributes, potentially resulting in XSS.
What can be done before upgrading?
Avoid custom :highlighter values that place placeholders inside HTML attribute values. Use the default highlighter or the block form instead when handling user-controlled text.
How can teams identify potentially affected code?
Review calls to ActionView::Helpers::TextHelper#highlight for custom :highlighter options. Prioritize patterns resembling <a href="search?q=\1">, where a placeholder is embedded in a quoted attribute value.