# CVE-2026-126070: Rails Action View strip_tags XSS in HTML attributes

Source: https://junglewise.ai/threats/cve-2026-126070-action-view-is-a-framework-for-handling-view-template-lookup-and  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-10. Updated: 2026-11-10  
License: CC BY 4.0 with a link back

CVE-2026-126070 · Severity: medium · CVSS 6.1 · Published 2026-11-10

Action View is a Rails framework component that renders HTML templates and provides helper functions for generating HTML. The strip_tags helper function removes HTML tags but was marking its output as safe without properly encoding quotation marks, allowing attackers to inject attributes or close HTML attribute context through untrusted input. This could lead to cross-site scripting (XSS) attacks when the sanitized output is used inside HTML attributes.

Technologies: [Rails Action View](https://junglewise.ai/threats/technologies/action-view), [actionview (RubyGems)](https://junglewise.ai/threats/technologies/actionview). Vendors: [Rails](https://junglewise.ai/threats/vendors/rails), [RubyGems](https://junglewise.ai/threats/vendors/rubygems).

## Quick answers

**Is CVE-2026-126070 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-126070 being exploited in the wild.

**How severe is CVE-2026-126070?** Medium severity, with a CVSS score of 6.1, published 10 November 2026.

**Which products and versions are affected?** Rails Action View prior to 8.1.4.1 and 8.0.5.2; actionview (RubyGems) >= 8.1.0.beta1, < 8.1.4.1.

**Is there a fix for CVE-2026-126070?** Yes: fixed in 8.1.4.1, 8.0.5.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-126070 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-126070?** Check whether you run Rails Action View or actionview (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 8.1.4.1, 8.0.5.2

## Technical details

The strip_tags method encodes &, <, and > but failed to encode " and ' characters. Because the output is marked html_safe, ERB template rendering skips additional escaping. An attacker providing input with quotes can break out of an HTML attribute context (e.g., title="INPUT") and inject new attributes or event handlers. The vulnerability requires untrusted input to be passed through strip_tags and rendered within an HTML attribute value; rendering as element content is not affected.

## Affected products

- Rails Action View prior to 8.1.4.1 and 8.0.5.2

## Identifiers

- CVE-2026-126070
- GHSA-rq8q-p985-fjq7

## Timeline

- 2026-11-10: disclosed

## References

- [https://github.com/rails/rails/commit/568b19cb860322885593e308a7f27aceb779e9d7](https://github.com/rails/rails/commit/568b19cb860322885593e308a7f27aceb779e9d7)
- [https://github.com/rails/rails/commit/c3772a10f405f9644125cbb484adfd2aa7a25a59](https://github.com/rails/rails/commit/c3772a10f405f9644125cbb484adfd2aa7a25a59)

## Related threats

- [Rails Action View XSS via HTML5 sanitizer in text helpers](https://junglewise.ai/threats/cve-2026-126079-action-view-is-a-framework-for-handling-view-template-lookup-and)
- [Rails Action View TextHelper highlight XSS](https://junglewise.ai/threats/cve-2026-126078-action-view-is-a-framework-for-handling-view-template-lookup-and)
- [Ruby on Rails Action View XSS in tag helpers via whitespace attribute names](https://junglewise.ai/threats/cve-2026-126069-action-view-is-a-framework-for-handling-view-template-lookup-and)
- [Rails has a possible XSS vulnerability in its Action View tag helpers](https://junglewise.ai/threats/cve-2026-33168-rails-has-a-possible-xss-vulnerability-in-its-action-view-tag)
- [rails-ujs vulnerable to DOM Based Cross-site Scripting contenteditable HTML Elements](https://junglewise.ai/threats/cve-2023-23913-rails-ujs-vulnerable-to-dom-based-cross-site-scripting)