PT-2026-27257 · Unknown+1 · Active Support+1

Jean Boussier · Published 2026-03-23 · Updated 2026-05-08 · CVE-2026-33170

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Active Support versions prior to 8.1.2.1 Active Support versions prior to 8.0.4.1 Active Support versions prior to 7.2.3.1

Description The SafeBuffer#% function does not correctly propagate the @html unsafe flag to newly created buffers. If a SafeBuffer is modified in place, such as through the gsub! function, and then formatted using the % operator with untrusted input, the resulting buffer may incorrectly report as html safe? == true. This can bypass ERB auto-escaping, potentially leading to cross-site scripting (XSS).

Recommendations Update to Active Support version 8.1.2.1 or later. Update to Active Support version 8.0.4.1 or later. Update to Active Support version 7.2.3.1 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2026-07238

CVE-2026-33170

GHSA-89VF-4333-QX8V

Affected Products

Active Support

Red Os

References · 25

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33170.json · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activesupport/CVE-2026-33170.yml · Exploit
• https://github.com/rails/rails/commit/50d732af3b7c8aaf63cbcca0becbc00279b215b7 · Patch
• https://github.com/rails/rails/commit/c1ad0e8e1972032f3395853a5e99cea035035beb · Patch
• https://github.com/rails/rails/security/advisories/GHSA-89vf-4333-qx8v · Vendor Advisory
• https://github.com/rails/rails/commit/6e8a81108001d58043de9e54a06fca58962fc2db · Patch
• https://osv.dev/vulnerability/GHSA-89vf-4333-qx8v · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-33170 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-33170 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-33170 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-33170 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-33170 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-33170 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-33170 · Security Note
• https://bdu.fstec.ru/vul/2026-07238 · Security Note