Action View: Possible XSS via whitespace attribute names in tag helpers
Summary
Action View, the view rendering component of Ruby on Rails, can emit malformed HTML when a whitespace-only attribute name reaches the tag helpers, including image_tag, video_tag and audio_tag. A crafted attribute value can then be interpreted by the browser as a separate attribute, which may lead to Cross-Site Scripting (XSS). The issue only matters if the application lets users specify custom HTML attribute names. The earlier fix for CVE-2026-33168 was incomplete.
Affected
- Action View 8.1 before 8.1.4.1
- Action View before 8.0.5.2
- Older branches: Unknown.
Fixed in
- Upgrade to 8.1.4.1
- Upgrade to 8.0.5.2
Workaround
- Unknown. No vendor workaround found.
- Do not pass user-controlled strings as HTML attribute names to tag helpers.
- Restrict user-defined attribute names to a fixed allowlist.
Exploitation
- Not listed in CISA KEV.
- EPSS score 0.00235.
- No public proof of concept found; this does not prove none exists.
- No known exploitation in the wild.
Our recommendation
- Check whether any application lets users define HTML attribute names.
- Upgrade affected Rails applications to 8.1.4.1 or 8.0.5.2 as part of the same batch as the other November 2026 Rails security fixes.
- Until patched, apply the allowlist restriction for user-defined attribute names.
- Note: the release also fixes a Critical Active Storage flaw (GHSA-f3w6-w445-fwh9), which is the higher priority.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-68p9-83h6-5wpj github.com
- CVE Record CVE-2026-126069 www.cve.org
- Fix commit 9190210 github.com
- Fix commit f474525 github.com
- Rails v8.1.4.1 release github.com
- Rails v8.0.5.2 release github.com
- Rails security releases announcement rubyonrails.org
- OpenCVE CVE-2026-126069 app.opencve.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 20:15.
Original description (NVD)
Action View is a framework for handling view template lookup and rendering and provides view helpers for building HTML. Prior to 8.1.4.1 and 8.0.5.2, the fix for CVE-2026-33168 skips blank HTML attribute names in Action View tag helpers, but it tests the name before converting it to a string. A Symbol name made only of whitespace, such as :" ", is not blank, because Symbol#blank? is Symbol#empty?, so it reaches the attribute escaping, which emits an attribute with no name and produces malformed HTML. The asset tag helpers, such as image_tag, video_tag and audio_tag, symbolize their options, so a whitespace String name passed to them takes the same path. A carefully crafted attribute value could then be misinterpreted by the browser as a separate attribute name, possibly leading to XSS. Applications that allow users to specify custom HTML attribute names are affected. This issue is fixed in versions 8.1.4.1 and 8.0.5.2.
NVD references (5)
- https://github.com/rails/rails/commit/9190210606ffe52f92fdc75637f8ff69404f22c8
- https://github.com/rails/rails/commit/f47452533e1f28d847c63181b9d5f8b7243ef9a4
- https://github.com/rails/rails/releases/tag/v8.0.5.2
- https://github.com/rails/rails/releases/tag/v8.1.4.1
- https://github.com/rails/rails/security/advisories/GHSA-68p9-83h6-5wpj
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.