Ruby on Rails Action View: Cross-site scripting in highlight helper
Summary
The highlight helper in Action View inserts matched phrases into a custom :highlighter string without escaping quote characters, and marks the result as HTML-safe. If the highlighter places the placeholder inside a quoted attribute value and the highlighted text is user-controlled, an attacker can end the attribute and inject additional attributes, which may lead to cross-site scripting (XSS). The default highlighter and the block form are not affected.
Affected
- Rails Action View 8.1 before 8.1.4.1
- Rails Action View 8.0 before 8.0.5.2
- Only applications that pass a custom :highlighter with a placeholder inside an attribute value and highlight user-controlled text
Fixed in
- Rails 8.1.4.1
- Rails 8.0.5.2
Workaround
- Use the default highlighter <mark>\1</mark> or the block form of highlight, which are not affected
- Do not place user-controlled matches inside attribute values and HTML-escape user text before highlighting, if a custom highlighter is still needed
Exploitation
- As of 10 November 2026, not known to be exploited (preliminary)
- No public proof of concept found in the sources checked
Our recommendation
- Inventory Rails applications and check Gemfile.lock for Action View versions
- Upgrade to 8.1.4.1 or 8.0.5.2; note that security support for 8.0 ends on 7 November 2026, so plan a move to 8.1
- Search code for highlight calls with a highlighter: argument and review placeholders inside attributes
- Apply the same release, which also fixes 21 other issues, as part of the normal patch cycle
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-v6rj-xm57-3p59 github.com
- Patch commit for 8.1 (06938194) github.com
- Patch commit for 8.0 (c796f619) github.com
- Rails v8.1.4.1 release github.com
- Rails v8.0.5.2 release github.com
- CVE Record CVE-2026-126078 www.cve.org
- Rails security release announcement rubyonrails.org
- OffSeq threat radar entry radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 14:13.
Original description (NVD)
Action View is a framework for handling view template lookup and rendering and provides view helpers for building HTML. Prior to 8.1.4.1 and 8.0.5.2, ActionView::Helpers::TextHelper#highlight substitutes each matched phrase into the :highlighter string without escaping it and returns the result marked HTML-safe. Because sanitizing leaves quote characters in text unescaped, a match substituted into a quoted attribute value of the highlighter, such as the <a href="search?q=\1"> form shown in the method's documentation, could end the attribute value and add attributes to the element, possibly leading to XSS. Applications are affected when they pass a :highlighter that places a placeholder inside an attribute value and highlight text or phrases that a user controls. The default <mark>\1</mark> highlighter and the block form are not affected. This issue is fixed in versions 8.1.4.1 and 8.0.5.2.
NVD references (5)
- https://github.com/rails/rails/commit/06938194b4fd59e1d2c8ab4a781f3c1e2b763425
- https://github.com/rails/rails/commit/c796f6198837479ada13290eb8fa767b5219a58a
- https://github.com/rails/rails/releases/tag/v8.0.5.2
- https://github.com/rails/rails/releases/tag/v8.1.4.1
- https://github.com/rails/rails/security/advisories/GHSA-v6rj-xm57-3p59
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.