Rails ActiveSupport: Cross-Site Scripting via MessagePack serialized SafeBuffer
Summary
ActiveSupport, the core library of Ruby on Rails, serializes an ActiveSupport::SafeBuffer as plain bytes with MessagePack. A buffer that was changed in place after it had become unsafe, for example with gsub!, is restored as html_safe when it is loaded again. If such a buffer holds untrusted input and is rendered later, ERB auto-escaping is bypassed, which can lead to Cross-Site Scripting (XSS).
Affected
- Rails 8.1 from 8.1.0 up to, but not including, 8.1.4.1 (activesupport gem)
- Only applications that use a MessagePack serializer (cookies_serializer :message_pack or :message_pack_allow_marshal, or serializer :message_pack for Rails.cache, MessageVerifier or MessageEncryptor) and store a SafeBuffer that was mutated in place with untrusted input
- Rails 8.0 and earlier are not affected according to the advisory
Fixed in
- Upgrade to ActiveSupport 8.1.4.1 or later
Workaround
- Before storing a value in a MessagePack serializer, convert SafeBuffer objects to a plain String with to_str
- Do not store SafeBuffer objects that contain untrusted input in MessagePack-serialized cookies, cache entries or signed/encrypted values
Exploitation
- Not known to be exploited
- Not listed in CISA KEV
- No public proof of concept identified
- EPSS below 1 percent (as reported by OpenCVE)
Our recommendation
- Inventory Rails applications and check Gemfile.lock for activesupport versions
- Upgrade Rails 8.1 applications to 8.1.4.1 or later; this release also fixes the critical Active Storage issue GHSA-f3w6-w445-fwh9
- If an upgrade is not possible yet, check whether MessagePack serializers are used and apply the to_str workaround
- Review code that renders user content from stored values for missing escaping
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-2w9f-fxwj-w2qf github.com
- Fix commit 4ca0906 (rails/rails) github.com
- Rails 8.1.4.1 release notes github.com
- OSV entry GHSA-2w9f-fxwj-w2qf osv.dev
- RubySec advisory GHSA-2w9f-fxwj-w2qf rubysec.com
- CVE Record CVE-2026-126075 www.cve.org
- OffSeq threat radar CVE-2026-126075 radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 20:14.
Original description (NVD)
Active Support is a collection of utility classes and standard library extensions used by Rails and other Ruby projects. From 8.1 until 8.1.4.1, ActiveSupport::MessagePack serializes an ActiveSupport::SafeBuffer as its bytes alone and deserializes it as a new SafeBuffer, so a buffer that is no longer html_safe? (for example, one mutated in place with gsub!) is restored as html_safe. If such a buffer holds untrusted input and is stored through a MessagePack serializer, rendering it after it is loaded bypasses ERB auto-escaping, possibly leading to XSS. Applications on Rails 8.1 are affected if they use a MessagePack serializer, such as config.action_dispatch.cookies_serializer = :message_pack or :message_pack_allow_marshal, or serializer: :message_pack for Rails.cache, ActiveSupport::MessageVerifier or ActiveSupport::MessageEncryptor, and store a SafeBuffer that was mutated in place with untrusted input. Rails 8.0 and earlier do not serialize SafeBuffer with MessagePack and are not affected. This issue is fixed in version 8.1.4.1.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.