# CVE-2026-126075: Rails Active Support MessagePack unsafe serialization XSS

Source: https://junglewise.ai/threats/cve-2026-126075-active-support-is-a-collection-of-utility-classes-and-standard  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-10. Updated: 2026-11-10  
License: CC BY 4.0 with a link back

CVE-2026-126075 · Severity: medium · CVSS 4.7 · Published 2026-11-10

Rails Active Support is a core library that extends Ruby with utility classes used by web applications. In Rails 8.1 before 8.1.4.1, a flaw in how the MessagePack serializer handles SafeBuffer objects can cause untrusted input to bypass HTML escaping when the application renders cached data, leading to cross-site scripting (XSS) attacks. This only affects applications explicitly using MessagePack as their serializer for cookies or caching.

Technologies: [activesupport (RubyGems)](https://junglewise.ai/threats/technologies/activesupport). Vendors: [Rails](https://junglewise.ai/threats/vendors/rails), [RubyGems](https://junglewise.ai/threats/vendors/rubygems).

## Quick answers

**Is CVE-2026-126075 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-126075 being exploited in the wild.

**How severe is CVE-2026-126075?** Medium severity, with a CVSS score of 4.7, published 10 November 2026.

**Which products and versions are affected?** Rails Active Support 8.1.0 through 8.1.4.0; activesupport (RubyGems) >= 8.1.0.beta1, < 8.1.4.1, ECOSYSTEM:introduced=8.1.0.beta1,fixed=8.1.4.1.

**Is there a fix for CVE-2026-126075?** Yes. activesupport (RubyGems): upgrade to 8.1.4.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-126075 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-126075?** Check whether you run Rails Active Support or activesupport (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- activesupport (RubyGems): upgrade to 8.1.4.1 or later

  ```sh
  bundle update activesupport
  ```


## Technical details

The vulnerability exists in ActiveSupport::MessagePack's handling of SafeBuffer objects, which are normally marked as HTML-safe and not escaped by ERB. When a SafeBuffer is mutated in-place (e.g., with gsub!) containing untrusted input, the serializer loses the unsafe status and deserializes it back as html_safe, bypassing auto-escaping on render. An attacker can exploit this by storing a mutated SafeBuffer through a MessagePack serializer (cookies, cache, or MessageVerifier/MessageEncryptor) and causing its rendering in a template.

## Affected products

- Rails Active Support 8.1.0 through 8.1.4.0

## Identifiers

- CVE-2026-126075
- GHSA-2w9f-fxwj-w2qf

## Timeline

- 2026-11-10: disclosed

## References

- [https://github.com/rails/rails/commit/4ca090665976e6fbc471c38689b399f84b43cdc7](https://github.com/rails/rails/commit/4ca090665976e6fbc471c38689b399f84b43cdc7)
- [https://github.com/rails/rails/releases/tag/v8.1.4.1](https://github.com/rails/rails/releases/tag/v8.1.4.1)

## Related threats

- [Rails Active Support regular expression injection in safe_constantize](https://junglewise.ai/threats/cve-2026-126080-active-support-is-a-collection-of-utility-classes-and-standard)
- [Rails Active Support has a possible DoS vulnerability in its number helpers](https://junglewise.ai/threats/cve-2026-33176-rails-active-support-has-a-possible-dos-vulnerability-in-its)
- [Ruby on Rails Active Support XSS in SafeBuffer](https://junglewise.ai/threats/cve-2026-33170-ruby-on-rails-active-support-xss-in-safebuffer)
- [Rails Active Support has a possible ReDoS vulnerability in number_to_delimited](https://junglewise.ai/threats/cve-2026-33169-rails-active-support-has-a-possible-redos-vulnerability-in-number)
- [Active Support Possibly Discloses Locally Encrypted Files](https://junglewise.ai/threats/cve-2023-38037-active-support-possibly-discloses-locally-encrypted-files)