Rails Action View: Cross-site scripting in text helpers highlight and simple_format
Summary
Action View's highlight and simple_format helpers can re-emit markup from HTML attribute values that the HTML5 sanitizer had left inert, when the Nokogiri serializer does not escape < and > in attributes. An attacker who can supply text passed to these helpers can therefore cause script to run in the browser of a user who views the page. The issue requires the HTML5 sanitizer, which is the default for applications using load_defaults 7.1 or later, and untrusted text passed to highlight or to simple_format with html_options; user interaction is required.
Affected
- Rails versions below 8.0.5.2
- Rails 8.1 versions below 8.1.4.1
- Applications using the HTML5 sanitizer with Nokogiri below 1.19.5 (rails-html-sanitizer below 1.7.2, Loofah below 2.25.3)
- Rails 7.2 and older: no fixed release published; affected status per third-party reading only
Fixed in
- Rails 8.0.5.2
- Rails 8.1.4.1
- Nokogiri 1.19.5 or later, rails-html-sanitizer 1.7.2 or later, Loofah 2.25.3 or later
Workaround
- Upgrade Nokogiri to 1.19.5 or later (documented by the vendor advisory as the escaping fix)
- Alternatively, set config.action_view.sanitizer_vendor = Rails::HTML4::Sanitizer
- These are partial measures; the full fixed set also requires rails-html-sanitizer 1.7.2+ and Loofah 2.25.3+
Exploitation
- Not known to be exploited (per one aggregator; no vendor or CISA statement found)
- No public proof of concept found as of the research date
Our recommendation
- Identify Rails applications and check whether they use highlight or simple_format with html_options on untrusted text
- Update to Rails 8.1.4.1 or 8.0.5.2 together with the rest of the security release, including the critical Active Storage fix
- Move Rails 8.0 applications to 8.1, as 8.0 security support ends 7 November 2026
- Plan upgrades for Rails 7.2 and older, which have no official fixed release
- Monitor the vendor advisory GHSA-2p2f-4rq4-gjwc for updates
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE Record CVE-2026-126079 www.cve.org
- Rails GitHub Security Advisory GHSA-2p2f-4rq4-gjwc github.com
- Rails 8.0.5.2 and 8.1.4.1 release announcement rubyonrails.org
- Rails release v8.1.4.1 github.com
- Rails release v8.0.5.2 github.com
- Rails commit adc3a32 (8.1 fix) github.com
- Rails commit 009ea68 (8.0 fix) github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 14:14.
Original description (NVD)
Action View is a framework for handling view template lookup and rendering and provides view helpers for building HTML. Prior to 8.1.4.1 and 8.0.5.2, with the HTML5 sanitizer (Rails::HTML5::Sanitizer, the default vendor on CRuby for applications using load_defaults 7.1 or later), Nokogiri before 1.19.5 serializes < and > unescaped inside attribute values. The Action View text helpers highlight and simple_format sanitize their input and then process the resulting HTML as a string: highlight splits it on tag boundaries to insert matches, and simple_format splits it into paragraphs on blank lines. An unescaped > or a blank line inside an attribute value could cause markup in that value, which the sanitizer left inert, to be emitted as live elements in the helper's html_safe output, possibly leading to XSS. Applications that use the HTML5 sanitizer and pass untrusted text to highlight, or to simple_format with html_options, are affected. This issue is fixed in versions 8.1.4.1 and 8.0.5.2.
NVD references (5)
- http://github.com/rails/rails/commit/adc3a32d4abea77ed3aacf6f5fb71cfc005bef73
- https://github.com/rails/rails/commit/009ea68342d05d02087c04dae7faaa4e4c1def11
- https://github.com/rails/rails/releases/tag/v8.0.5.2
- https://github.com/rails/rails/releases/tag/v8.1.4.1
- https://github.com/rails/rails/security/advisories/GHSA-2p2f-4rq4-gjwc
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.