PT-2026-27255 · Rails+1 · Rails+1

Jhawthorn · Published 2026-03-23 · Updated 2026-05-06 · CVE-2026-33168

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Rails versions prior to 8.1.2.1 Rails versions prior to 8.0.4.1 Rails versions prior to 7.2.3.1

Description Action View tag helpers are susceptible to an issue where attribute escaping is bypassed when a blank string is used as an HTML attribute name, resulting in malformed HTML. A specially crafted attribute value could be misinterpreted by the browser as a separate attribute name, potentially leading to cross-site scripting (XSS). Applications that permit users to define custom HTML attributes are at risk.

Recommendations Update to Rails version 8.1.2.1 or later. Update to Rails version 8.0.4.1 or later. Update to Rails version 7.2.3.1 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2026-07241

CVE-2026-33168

GHSA-V55J-83PF-R9CQ

Affected Products

Rails

Red Os

References · 23

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33168.json · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionview/CVE-2026-33168.yml · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-33168 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-33168 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-07241 · Security Note
• https://osv.dev/vulnerability/GHSA-v55j-83pf-r9cq · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-33168 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-33168 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-33168 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-33168 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-33168 · Vendor Advisory
• https://github.com/rails/rails/commit/c79a07df1e88738df8f68cb0ee759ad6128ca924 · Note
• https://github.com/rails/rails/security/advisories/GHSA-v55j-83pf-r9cq · Note
• https://github.com/rails/rails/commit/63f5ad83edaa0b976f82d46988d745426aa4a42d · Note
• https://github.com/rails/rails · Note