Vulnerabilities

Action View is a framework for handling view template lookup and rendering and provides view helpers for building HTML.

Action View is a framework for handling view template lookup and rendering and provides view helpers for building HTML. Prior to 8.1.4.1 and 8.0.5.2, with the HTML5 sanitizer (Rails::HTML5::Sanitizer, the default vendor on CRuby for applications using load_defaults 7.1 or later), Nokogiri before 1.19.5 serializes < and > unescaped inside attribute values. The Action View text helpers highlight and simple_format sanitize their input and then process the resulting HTML as a string: highlight splits it on tag boundaries to insert matches, and simple_format splits it into paragraphs on blank lines. An unescaped > or a blank line inside an attribute value could cause markup in that value, which t

Read at NIST National Vulnerability Database (CVE API 2.0)

Vendor

Ruby on Rails

Product

rails

CVSS v3.1

6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Fix

available

Weakness

CWE-79

Exposure class

Web platform

NVD status

Received

• NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
• CVE-2026-126079 on this site · NVD · CVE.org · Vulnpedia

Other items that share a CVE or were clustered with this one.

1. 28
   CVE NVD 6h ago

   Action View is a framework for handling view template lookup and rendering and provides view helpers for building HTML.

   CVSS 6.1 Fix available CVE-2026-126078 Ruby on Rails
2. 23
   CVE NVD 6h ago

   Action View is a framework for handling view template lookup and rendering and provides view helpers for building HTML.

   CVSS 6.1 Fix available CVE-2026-126070 Ruby on Rails
3. 23
   CVE NVD 6h ago

   Action View is a framework for handling view template lookup and rendering and provides view helpers for building HTML.

   CVSS 4.7 Fix available CVE-2026-126069 Ruby on Rails