CVE-2026-126079: Rails Action View XSS via HTML5 sanitizer in text helpers

CVE-2026-126079 · Severity: medium · CVSS 6.1 · Published 2026-11-10

Rails Action View is a web framework component that renders HTML templates and provides helper functions for building HTML output. Due to improper escaping in the HTML5 sanitizer, attackers can inject unescaped markup into attribute values that the text helpers (highlight and simple_format) then emit as live HTML elements, leading to cross-site scripting (XSS) attacks. Applications using the HTML5 sanitizer (default in Rails 7.1+) with untrusted input to these helpers are vulnerable.

Technologies: Rails Action View, actionview (RubyGems). Vendors: Nokogiri, Rails, RubyGems.

Quick answers

Is CVE-2026-126079 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-126079 being exploited in the wild.
How severe is CVE-2026-126079?
Medium severity, with a CVSS score of 6.1, published 10 November 2026.
Which products and versions are affected?
Nokogiri before 1.19.5; Rails Action View before 8.1.4.1 and 8.0.5.2; Rails-Html-Sanitizer before 1.7.2; actionview (RubyGems) >= 8.1.0.beta1, < 8.1.4.1.
Is there a fix for CVE-2026-126079?
Yes: fixed in Action View 8.1.4.1, 8.0.5.2; rails-html-sanitizer 1.7.2; Nokogiri 1.19.5. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-126079 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-126079?
Check whether you run Nokogiri, Rails Action View, Rails-Html-Sanitizer or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: Action View 8.1.4.1, 8.0.5.2; rails-html-sanitizer 1.7.2; Nokogiri 1.19.5

Technical details

A vulnerability in Rails Action View's text helpers (highlight and simple_format) combined with the HTML5 sanitizer allows XSS when processing untrusted input. The sanitizer fails to properly escape `&lt;` and `&gt;` inside attribute values due to a Nokogiri serialization issue before version 1.19.5; the helpers then split the sanitized HTML on tag boundaries or blank lines, causing previously inert markup in attribute values to be emitted as live elements in the output. The attack requires passing untrusted text to highlight() or simple_format() with html_options, and only affects applications using the HTML5 sanitizer (default for load_defaults 7.1 or later on CRuby).

Affected products

  • Rails Action View before 8.1.4.1 and 8.0.5.2
  • Rails rails-html-sanitizer before 1.7.2
  • Nokogiri Nokogiri before 1.19.5

Identifiers

  • CVE-2026-126079
  • GHSA-2p2f-4rq4-gjwc

Timeline

  • 2026-11-10: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.