Is CVE-2026-126078 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-126078 being exploited in the wild.

How severe is CVE-2026-126078?

Medium severity, with a CVSS score of 6.1, published 10 November 2026.

Which products and versions are affected?

Rails Action View before 8.1.4.1 and 8.0.5.2; actionview (RubyGems) >= 8.1.0.beta1, < 8.1.4.1.

Is there a fix for CVE-2026-126078?

Yes: fixed in 8.1.4.1, 8.0.5.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-126078 attacked?

It is attacked over the network.

Am I affected by CVE-2026-126078?

Check whether you run Rails Action View or actionview (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-126078: Rails Action View TextHelper highlight XSS

Q: Is there a fix for CVE-2026-126078?

Yes: fixed in 8.1.4.1, 8.0.5.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-126078 attacked?

It is attacked over the network.

Q: Am I affected by CVE-2026-126078?

Check whether you run Rails Action View or actionview (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-126078 · Severity: medium · CVSS 6.1 · Published 2026-11-10

Ruby on Rails' Action View is a web framework component that renders HTML templates. The TextHelper#highlight method used to mark search terms in text failed to escape user-controlled input before inserting it into HTML attributes, allowing attackers to inject malicious attributes like event handlers and execute arbitrary JavaScript in a user's browser.

Technologies: Rails Action View, actionview (RubyGems). Vendors: Rails, RubyGems.

Quick answers

Is CVE-2026-126078 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-126078 being exploited in the wild.
How severe is CVE-2026-126078?: Medium severity, with a CVSS score of 6.1, published 10 November 2026.
Which products and versions are affected?: Rails Action View before 8.1.4.1 and 8.0.5.2; actionview (RubyGems) >= 8.1.0.beta1, < 8.1.4.1.
Is there a fix for CVE-2026-126078?: Yes: fixed in 8.1.4.1, 8.0.5.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-126078 attacked?: It is attacked over the network.
Am I affected by CVE-2026-126078?: Check whether you run Rails Action View or actionview (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 8.1.4.1, 8.0.5.2

Technical details

The highlight helper substitutes matched phrases into a :highlighter template without HTML-escaping the matched text. When the highlighter contains a placeholder inside a quoted attribute (e.g., href="search?q=\1"), an attacker-controlled match containing quotes can break out of the attribute and inject additional HTML attributes such as onfocus, leading to stored or reflected XSS. The vulnerability requires the application to use a custom highlighter with placeholders in attribute values and process user-controlled highlight phrases.

Affected products

Rails Action View before 8.1.4.1 and 8.0.5.2

Identifiers

CVE-2026-126078
GHSA-v6rj-xm57-3p59

Timeline

2026-11-10: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.