UBUNTU-CVE-2026-126079: XSS
Action View is a framework for handling view template lookup and rendering and provides view helpers for building HTML. Prior to 8.1.4.1 and 8.0.5.2, with the HTML5 sanitizer (Rails::HTML5::Sanitizer, the default vendor on CRuby for applications using loaddefaults 7.1 or later), Nokogiri before 1.19.5 serializes < and > unescaped inside attribute values. The Action View text helpers highlight and simpleformat sanitize their input and then process the resulting HTML as a string: highlight splits it on tag boundaries to insert matches, and simpleformat splits it into paragraphs on blank lines. An unescaped > or a blank line inside an attribute value could cause markup in that value, which the sanitizer left inert, to be emitted as live elements in the helper's htmlsafe output, possibly leading to XSS. Applications that use the HTML5 sanitizer and pass untrusted text to highlight, or to simpleformat with htmloptions, are affected. This issue is fixed in versions 8.1.4.1 and 8.0.5.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Action Viewto a version that resolves this vulnerability.Fixed in 8.1.4.1 - Upgrade
Upgrade
Action Viewto a version that resolves this vulnerability.Fixed in 8.0.5.2 - Upgrade
Upgrade
Nokogirito a version that resolves this vulnerability.Fixed in 1.19.5
Event History
Frequently Asked Questions
Which applications are affected by this issue?
Applications are affected when they use the HTML5 sanitizer and pass untrusted text to the highlight helper, or to simple_format with html_options. The HTML5 sanitizer is the default vendor on CRuby for applications using load_defaults 7.1 or later.
What input is needed to trigger the unsafe output?
The issue depends on unescaped < or > characters inside an attribute value. For highlight, the helper's tag-boundary splitting can expose markup in that value; for simple_format, a blank line inside an attribute value can do so.
How can I determine whether my deployment needs remediation?
Check whether the application uses Rails versions earlier than 8.1.4.1 or 8.0.5.2, uses Rails::HTML5::Sanitizer, and sends untrusted text through the affected helper paths. Also check the installed Nokogiri version, as the issue applies to Nokogiri versions before 1.19.5.
What versions contain the fix?
The issue is fixed in Rails 8.1.4.1 and 8.0.5.2. The affected sanitizer behavior is associated with Nokogiri versions before 1.19.5.