# CVE-2026-33167: Rails has a possible XSS vulnerability in its Action Pack debug exceptions

Source: https://junglewise.ai/threats/cve-2026-33167-rails-has-a-possible-xss-vulnerability-in-its-action-pack-debug  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-23. Updated: 2026-05-11  
License: CC BY 4.0 with a link back

CVE-2026-33167 · Severity: medium · CVSS 4 · Published 2026-03-23

### Impact
The debug exceptions page does not properly escape exception messages. A carefully crafted exception message could inject arbitrary HTML and JavaScript into the page, leading to XSS. This affects applications with detailed exception pages enabled (`config.consider_all_requests_local = true`), which is the default in development.

### Releases
The fixed releases are available at the normal locations.

### Credit
This issue was responsibly reported by Hackerone researcher [fbettag](https://hackerone.com/fbettag).

Technologies: [actionpack (RubyGems)](https://junglewise.ai/threats/technologies/actionpack). Vendors: [RubyGems](https://junglewise.ai/threats/vendors/rubygems).

## Quick answers

**Is CVE-2026-33167 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-33167 being exploited in the wild.

**How severe is CVE-2026-33167?** Medium severity, with a CVSS score of 4, published 23 March 2026.

**Which products and versions are affected?** actionpack (RubyGems) >= 8.1.0, < 8.1.2.1, ECOSYSTEM:introduced=8.1.0,fixed=8.1.2.1.

**Is there a fix for CVE-2026-33167?** Yes. actionpack (RubyGems): upgrade to 8.1.2.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2026-33167?** Check whether you run actionpack (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- actionpack (RubyGems): upgrade to 8.1.2.1 or later

  ```sh
  bundle update actionpack
  ```


## Affected products

- actionpack (RubyGems) >= 8.1.0, < 8.1.2.1, ECOSYSTEM:introduced=8.1.0,fixed=8.1.2.1

## Identifiers

- CVE-2026-33167
- GHSA-pgm4-439c-5jp6

## References

- [https://github.com/rails/rails/security/advisories/GHSA-pgm4-439c-5jp6](https://github.com/rails/rails/security/advisories/GHSA-pgm4-439c-5jp6)
- [https://github.com/rails/rails/commit/6752711c8c31d79ba50d13af6a6698a3b85415e0](https://github.com/rails/rails/commit/6752711c8c31d79ba50d13af6a6698a3b85415e0)
- [https://github.com/rails/rails/releases/tag/v8.1.2.1](https://github.com/rails/rails/releases/tag/v8.1.2.1)
- [https://api.github.com/repos/rails/rails/security-advisories/GHSA-pgm4-439c-5jp6](https://api.github.com/repos/rails/rails/security-advisories/GHSA-pgm4-439c-5jp6)

## Related threats

- [Rails Action Pack remote IP spoofing in request handling](https://junglewise.ai/threats/cve-2026-126083-action-pack-is-a-framework-for-handling-and-responding-to-web)
- [Rails Action Pack mass assignment bypass in Parameters#each_key](https://junglewise.ai/threats/cve-2026-126081-action-pack-is-a-framework-for-handling-and-responding-to-web)
- [Rails Action Pack session cookie exposure in cached responses](https://junglewise.ai/threats/cve-2026-126077-action-pack-is-a-framework-for-handling-and-responding-to-web)
- [Ruby on Rails Action Pack session restoration after logout](https://junglewise.ai/threats/cve-2026-126076-action-pack-is-a-framework-for-handling-and-responding-to-web)
- [Rails Action Pack cache poisoning via content-type negotiation](https://junglewise.ai/threats/cve-2026-126073-action-pack-is-a-framework-for-handling-and-responding-to-web)