PT-2026-27257 · Unknown+1 · Active Support+1

Jean Boussier · Publicado 2026-03-23 · Atualizado 2026-05-08 · CVE-2026-33170

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Active Support versions prior to 8.1.2.1 Active Support versions prior to 8.0.4.1 Active Support versions prior to 7.2.3.1

Description The SafeBuffer#% function does not correctly propagate the @html unsafe flag to newly created buffers. If a SafeBuffer is modified in place, such as through the gsub! function, and then formatted using the % operator with untrusted input, the resulting buffer may incorrectly report as html safe? == true. This can bypass ERB auto-escaping, potentially leading to cross-site scripting (XSS).

Recommendations Update to Active Support version 8.1.2.1 or later. Update to Active Support version 8.0.4.1 or later. Update to Active Support version 7.2.3.1 or later.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

BDU:2026-07238

CVE-2026-33170

GHSA-89VF-4333-QX8V

Produtos afetados

Active Support

Red Os

Referências · 25

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33170.json · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activesupport/CVE-2026-33170.yml · Exploit
• https://github.com/rails/rails/commit/50d732af3b7c8aaf63cbcca0becbc00279b215b7 · Correção
• https://github.com/rails/rails/commit/c1ad0e8e1972032f3395853a5e99cea035035beb · Correção
• https://github.com/rails/rails/security/advisories/GHSA-89vf-4333-qx8v · Aviso do Fabricante
• https://github.com/rails/rails/commit/6e8a81108001d58043de9e54a06fca58962fc2db · Correção
• https://github.com/rails/rails · Nota
• https://github.com/rails/rails/releases/tag/v7.2.3.1 · Nota
• https://github.com/rails/rails/releases/tag/v8.1.2.1 · Nota
• https://github.com/rails/rails/releases/tag/v8.0.4.1 · Nota
• https://twitter.com/CVEarity/status/2036463878792696027 · Publicação no Twitter
• https://osv.dev/vulnerability/GHSA-89vf-4333-qx8v · Aviso do Fabricante
• https://access.redhat.com/security/cve/cve-2026-33170 · Nota
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/uyazvimost-rubygem-activesupport-cve-2026-33170-7.3 · Nota
• https://security-tracker.debian.org/tracker/CVE-2026-33170 · Aviso do Fabricante