Is CVE-2026-126070 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-126070 being exploited in the wild.

How severe is CVE-2026-126070?

Medium severity, with a CVSS score of 6.1, published 10 November 2026.

Which products and versions are affected?

Rails Action View prior to 8.1.4.1 and 8.0.5.2; actionview (RubyGems) >= 8.1.0.beta1, < 8.1.4.1.

Is there a fix for CVE-2026-126070?

Yes: fixed in 8.1.4.1, 8.0.5.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-126070 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-126070?

Check whether you run Rails Action View or actionview (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-126070: Rails Action View strip_tags XSS in HTML attributes

Q: Is there a fix for CVE-2026-126070?

Yes: fixed in 8.1.4.1, 8.0.5.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-126070 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-126070?

Check whether you run Rails Action View or actionview (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-126070 · Severity: medium · CVSS 6.1 · Published 2026-11-10

Action View is a Rails framework component that renders HTML templates and provides helper functions for generating HTML. The strip_tags helper function removes HTML tags but was marking its output as safe without properly encoding quotation marks, allowing attackers to inject attributes or close HTML attribute context through untrusted input. This could lead to cross-site scripting (XSS) attacks when the sanitized output is used inside HTML attributes.

Technologies: Rails Action View, actionview (RubyGems). Vendors: Rails, RubyGems.

Quick answers

Is CVE-2026-126070 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-126070 being exploited in the wild.
How severe is CVE-2026-126070?: Medium severity, with a CVSS score of 6.1, published 10 November 2026.
Which products and versions are affected?: Rails Action View prior to 8.1.4.1 and 8.0.5.2; actionview (RubyGems) >= 8.1.0.beta1, < 8.1.4.1.
Is there a fix for CVE-2026-126070?: Yes: fixed in 8.1.4.1, 8.0.5.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-126070 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-126070?: Check whether you run Rails Action View or actionview (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 8.1.4.1, 8.0.5.2

Technical details

The strip_tags method encodes &, <, and > but failed to encode " and ' characters. Because the output is marked html_safe, ERB template rendering skips additional escaping. An attacker providing input with quotes can break out of an HTML attribute context (e.g., title="INPUT") and inject new attributes or event handlers. The vulnerability requires untrusted input to be passed through strip_tags and rendered within an HTML attribute value; rendering as element content is not affected.

Affected products

Rails Action View prior to 8.1.4.1 and 8.0.5.2

Identifiers

CVE-2026-126070
GHSA-rq8q-p985-fjq7

Timeline

2026-11-10: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.