Rails Action View: Cross-site scripting in strip_tags output within HTML attributes
Summary
Action View's strip_tags helper returns its output marked as html_safe, but it only encodes &, < and >, leaving double and single quotes unencoded. If an application renders this output from untrusted input inside a quoted HTML attribute, such as a title attribute or a meta content tag, an attacker can break out of the attribute and inject new attributes, possibly leading to cross-site scripting. Output rendered as element content is not affected.
Affected
- Rails versions below 8.0.5.2
- Rails 8.1 versions below 8.1.4.1
Fixed in
- Rails 8.0.5.2
- Rails 8.1.4.1
- Rails 7.2, 7.1 and 6.1 are not fixed upstream (unsupported)
Workaround
- Do not place strip_tags output into HTML attributes; use a tag helper such as tag.a(title: strip_tags(user_input)), which escapes attribute values.
- Output rendered as element content is not affected.
Exploitation
Unknown. No reports of in-the-wild exploitation or public proof of concept were found at the time of research.
Our recommendation
- Upgrade to Rails 8.1.4.1, or to 8.0.5.2 if the application cannot move to 8.1 yet. Note that Rails 8.0 security support ends after this release.
- Check whether untrusted input passes through strip_tags into attribute values, and apply the tag-helper workaround where patching is delayed.
- Test for changed output, since quotes are now encoded as " and '.
- Prioritise the critical Active Storage fix GHSA-f3w6-w445-fwh9 in the same release if uploads are processed with mini_magick.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GHSA-rq8q-p985-fjq7 Security Advisory github.com
- Fix commit 568b19c github.com
- Fix commit c3772a1 github.com
- Rails 8.0.5.2 release github.com
- Rails 8.1.4.1 release github.com
- Rails security release announcement rubyonrails.org
- ActionView SanitizeHelper documentation edgeapi.rubyonrails.org
- CVE-2026-126070 CNA record summary www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 14:15.
Original description (NVD)
Action View is a framework for handling view template lookup and rendering and provides view helpers for building HTML. Prior to 8.1.4.1 and 8.0.5.2, strip_tags in Action View returns its sanitized output marked html_safe, but the underlying sanitizer encodes only &, < and >, leaving " and ' unencoded. Because ERB does not escape a string marked html_safe, untrusted input passed through strip_tags and rendered inside a quoted HTML attribute value could close the attribute and add new attributes, possibly leading to XSS. Applications that render strip_tags output from untrusted input inside an HTML attribute, for example in a title attribute or a <meta content> tag, are affected. Output rendered as element content is not affected. This issue is fixed in versions 8.1.4.1 and 8.0.5.2.
NVD references (5)
- https://github.com/rails/rails/commit/568b19cb860322885593e308a7f27aceb779e9d7
- https://github.com/rails/rails/commit/c3772a10f405f9644125cbb484adfd2aa7a25a59
- https://github.com/rails/rails/releases/tag/v8.0.5.2
- https://github.com/rails/rails/releases/tag/v8.1.4.1
- https://github.com/rails/rails/security/advisories/GHSA-rq8q-p985-fjq7
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.