Is CVE-2026-126075 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-126075 being exploited in the wild.

How severe is CVE-2026-126075?

Medium severity, with a CVSS score of 4.7, published 10 November 2026.

Which products and versions are affected?

Rails Active Support 8.1.0 through 8.1.4.0; activesupport (RubyGems) >= 8.1.0.beta1, < 8.1.4.1, ECOSYSTEM:introduced=8.1.0.beta1,fixed=8.1.4.1.

Is there a fix for CVE-2026-126075?

Yes. activesupport (RubyGems): upgrade to 8.1.4.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-126075 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-126075?

Check whether you run Rails Active Support or activesupport (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-126075: Rails Active Support MessagePack unsafe serialization XSS

Q: Is there a fix for CVE-2026-126075?

Yes. activesupport (RubyGems): upgrade to 8.1.4.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-126075 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-126075?

Check whether you run Rails Active Support or activesupport (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-126075 · Severity: medium · CVSS 4.7 · Published 2026-11-10

Rails Active Support is a core library that extends Ruby with utility classes used by web applications. In Rails 8.1 before 8.1.4.1, a flaw in how the MessagePack serializer handles SafeBuffer objects can cause untrusted input to bypass HTML escaping when the application renders cached data, leading to cross-site scripting (XSS) attacks. This only affects applications explicitly using MessagePack as their serializer for cookies or caching.

Technologies: activesupport (RubyGems). Vendors: Rails, RubyGems.

Quick answers

Is CVE-2026-126075 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-126075 being exploited in the wild.
How severe is CVE-2026-126075?: Medium severity, with a CVSS score of 4.7, published 10 November 2026.
Which products and versions are affected?: Rails Active Support 8.1.0 through 8.1.4.0; activesupport (RubyGems) >= 8.1.0.beta1, < 8.1.4.1, ECOSYSTEM:introduced=8.1.0.beta1,fixed=8.1.4.1.
Is there a fix for CVE-2026-126075?: Yes. activesupport (RubyGems): upgrade to 8.1.4.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-126075 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-126075?: Check whether you run Rails Active Support or activesupport (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

activesupport (RubyGems): upgrade to 8.1.4.1 or later
```
bundle update activesupport
```

Technical details

The vulnerability exists in ActiveSupport::MessagePack's handling of SafeBuffer objects, which are normally marked as HTML-safe and not escaped by ERB. When a SafeBuffer is mutated in-place (e.g., with gsub!) containing untrusted input, the serializer loses the unsafe status and deserializes it back as html_safe, bypassing auto-escaping on render. An attacker can exploit this by storing a mutated SafeBuffer through a MessagePack serializer (cookies, cache, or MessageVerifier/MessageEncryptor) and causing its rendering in a template.

Affected products

Rails Active Support 8.1.0 through 8.1.4.0

Identifiers

CVE-2026-126075
GHSA-2w9f-fxwj-w2qf

Timeline

2026-11-10: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.