CVE-2026-126069: Ruby on Rails Action View XSS in tag helpers via whitespace attribute names

CVE-2026-126069 · Severity: medium · CVSS 4.7 · Published 2026-11-10

Rails Action View is a templating framework that generates HTML in web applications. A flaw in tag helper functions (image_tag, video_tag, audio_tag, picture_tag) allows attackers to inject whitespace-only HTML attribute names that are misinterpreted by browsers as separate attributes, potentially enabling XSS attacks if the application accepts user-controlled attribute names. This affects Rails applications that allow custom HTML attributes from user input.

Technologies: Ruby on Rails Rails, actionview (RubyGems). Vendors: Ruby on Rails, RubyGems.

Quick answers

Is CVE-2026-126069 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-126069 being exploited in the wild.
How severe is CVE-2026-126069?
Medium severity, with a CVSS score of 4.7, published 10 November 2026.
Which products and versions are affected?
Ruby on Rails Rails before 8.0.5.2 and 8.1.4.1; actionview (RubyGems) >= 8.1.0.beta1, < 8.1.4.1.
Is there a fix for CVE-2026-126069?
Yes: fixed in Rails 8.0.5.2, 8.1.4.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-126069 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-126069?
Check whether you run Ruby on Rails Rails or actionview (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: Rails 8.0.5.2, 8.1.4.1

Technical details

The vulnerability exists in Action View's tag helpers where whitespace-only Symbol attribute names pass a blank check (because Symbol#blank? equals Symbol#empty?) but escape to empty strings, producing malformed HTML with unnamed attributes. The HTML5 tokenizer then misinterprets attribute values as attribute names, allowing XSS. The asset tag helpers symbolize their options, so String attribute names containing only whitespace also reach the vulnerable code path. Fixes test attribute names after converting to string rather than before.

Affected products

  • Ruby on Rails Rails before 8.0.5.2 and 8.1.4.1

Identifiers

  • CVE-2026-126069
  • GHSA-68p9-83h6-5wpj

Timeline

  • 2026-11-10: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.