Technology · RubyGems

actionview (RubyGems) vulnerabilities

Updated 13 November 2026, 03:07 UTC. Rebuilt every hour.

Junglewise Threat Intelligence has tracked 19 vulnerabilities in actionview (RubyGems): 4 in the last 7 days and 4 in the last 90 days, 2 of them critical and 2 exploited in the wild. The most recent, CVE-2026-126079, was published on 10 November 2026. Nothing was published in the last eight weeks.

Last 7 days: 4
Last 90 days: 4
Critical, all time: 2
Exploited in the wild: 2

About actionview (RubyGems)

ActionView is a Rails framework component for rendering templates and managing views.

Homepage

Latest actionview (RubyGems) vulnerabilities

CVE-2026-126079: Rails Action View XSS via HTML5 sanitizer in text helpersmediumCVSS 6.1EPSS 0.3%10 Nov 2026
CVE-2026-126078: Rails Action View TextHelper highlight XSSmediumCVSS 6.1EPSS 0.3%10 Nov 2026
CVE-2026-126070: Rails Action View strip_tags XSS in HTML attributesmediumCVSS 6.1EPSS 0.3%10 Nov 2026
CVE-2026-126069: Ruby on Rails Action View XSS in tag helpers via whitespace attribute namesmediumCVSS 4.7EPSS 0.2%10 Nov 2026
CVE-2026-33168: Rails has a possible XSS vulnerability in its Action View tag helpersmediumCVSS 4EPSS 0.9%23 Mar 2026
CVE-2023-23913: rails-ujs vulnerable to DOM Based Cross-site Scripting contenteditable HTML ElementslowCVSS 3.1EPSS 0.6%9 Jun 2023
CVE-2022-27777: XSS Vulnerability in Action View tag helperslowCVSS 3.1EPSS 1.6%27 Apr 2022
CVE-2020-15169: XSS in Action ViewlowCVSS 3.1EPSS 2.4%11 Sep 2020
CVE-2020-8163: Remote code execution via user-provided local names in ActionViewlowCVSS 3.1EPSS 82.0%7 Jul 2020
CVE-2020-8167: CSRF Vulnerability in rails-ujslowCVSS 3.1EPSS 1.5%7 Jul 2020
CVE-2020-5267: Cross site scripting vulnerability in ActionViewlowCVSS 3.1EPSS 1.5%19 Mar 2020
CVE-2019-5418: Path Traversal in Action Viewcriticalexploited in the wildCVSS 3.1EPSS 98.5%13 Mar 2019
CVE-2019-5419: Denial of Service Vulnerability in Action ViewlowCVSS 3.1EPSS 8.7%13 Mar 2019
Moderate severity vulnerability that affects actionviewinfo17 Sep 2018
Moderate severity vulnerability that affects actionviewinfo13 Aug 2018
CVE-2011-0446: Rails actionpack gem vulnerable to Cross-site ScriptinginfoEPSS 2.4%24 Oct 2017
CVE-2016-0752: Directory traversal vulnerability in Action View in Ruby on Railscriticalexploited in the wildCVSS 3EPSS 95.5%24 Oct 2017
CVE-2016-2097: actionview contains Path Traversal vulnerabilitylowCVSS 3EPSS 4.4%24 Oct 2017
CVE-2016-6316: actionview Cross-site Scripting vulnerabilitylowCVSS 3EPSS 3.4%24 Oct 2017

Most severe actionview (RubyGems) vulnerabilities

Exploited in the wild first, then by severity and CVSS score.

CVE-2019-5418: Path Traversal in Action Viewcriticalexploited in the wildCVSS 3.1EPSS 98.5%13 Mar 2019
CVE-2016-0752: Directory traversal vulnerability in Action View in Ruby on Railscriticalexploited in the wildCVSS 3EPSS 95.5%24 Oct 2017
CVE-2026-126079: Rails Action View XSS via HTML5 sanitizer in text helpersmediumCVSS 6.1EPSS 0.3%10 Nov 2026
CVE-2026-126078: Rails Action View TextHelper highlight XSSmediumCVSS 6.1EPSS 0.3%10 Nov 2026
CVE-2026-126070: Rails Action View strip_tags XSS in HTML attributesmediumCVSS 6.1EPSS 0.3%10 Nov 2026
CVE-2026-126069: Ruby on Rails Action View XSS in tag helpers via whitespace attribute namesmediumCVSS 4.7EPSS 0.2%10 Nov 2026
CVE-2026-33168: Rails has a possible XSS vulnerability in its Action View tag helpersmediumCVSS 4EPSS 0.9%23 Mar 2026
CVE-2020-8163: Remote code execution via user-provided local names in ActionViewlowCVSS 3.1EPSS 82.0%7 Jul 2020
CVE-2019-5419: Denial of Service Vulnerability in Action ViewlowCVSS 3.1EPSS 8.7%13 Mar 2019
CVE-2020-15169: XSS in Action ViewlowCVSS 3.1EPSS 2.4%11 Sep 2020

Vulnerabilities per week

Nothing was published in the last eight weeks. The last 13 weeks, by the week each vulnerability was published.

Vulnerabilities published per week, UTC
Week of	Bar	Vulns	Critical
17 Aug 2026		0	0
24 Aug 2026		0	0
31 Aug 2026		0	0
7 Sep 2026		0	0
14 Sep 2026		0	0
21 Sep 2026		0	0
28 Sep 2026		0	0
5 Oct 2026		0	0
12 Oct 2026		0	0
19 Oct 2026		0	0
26 Oct 2026		0	0
2 Nov 2026		0	0
9 Nov 2026		4	0

Embed a badge

A live badge for a README, a status page or an internal wiki: how many actionview (RubyGems) vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.

[![actionview (RubyGems) vulnerabilities](https://junglewise.ai/threats/technologies/actionview/badge.svg)](https://junglewise.ai/threats/technologies/actionview)

<a href="https://junglewise.ai/threats/technologies/actionview"><img src="https://junglewise.ai/threats/technologies/actionview/badge.svg" alt="actionview (RubyGems) vulnerabilities" /></a>

How this is built

Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.

The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.

Use this data

The same data is at https://junglewise.ai/threats/technologies/actionview.json, and this page as text at https://junglewise.ai/threats/technologies/actionview.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.

Cite as: Junglewise Threat Intelligence, "actionview (RubyGems) vulnerabilities", https://junglewise.ai/threats/technologies/actionview, 13 November 2026.