Rails Action View prior 8.0.5.2/8.1.4.1 HTML5 Sanitizer highlight/simple_format html_options HTML injection

Summaryinfo

A vulnerability labeled as problematic has been found in Rails Action View. This affects the function highlight/simple_format of the component HTML5 Sanitizer. Such manipulation of the argument html_options leads to HTML injection. This vulnerability is listed as CVE-2026-126079. The attack may be performed from remote. There is no available exploit. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in Rails Action View and classified as problematic. Affected by this issue is the function highlight/simple_format of the component HTML5 Sanitizer. The manipulation of the argument html_options with an unknown input leads to a html injection vulnerability. Using CWE to declare the problem leads to CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. Impacted is integrity. CVE summarizes:

Action View is a framework for handling view template lookup and rendering and provides view helpers for building HTML. Prior to 8.1.4.1 and 8.0.5.2, with the HTML5 sanitizer (Rails::HTML5::Sanitizer, the default vendor on CRuby for applications using load_defaults 7.1 or later), Nokogiri before 1.19.5 serializes < and > unescaped inside attribute values. The Action View text helpers highlight and simple_format sanitize their input and then process the resulting HTML as a string: highlight splits it on tag boundaries to insert matches, and simple_format splits it into paragraphs on blank lines. An unescaped > or a blank line inside an attribute value could cause markup in that value, which the sanitizer left inert, to be emitted as live elements in the helper's html_safe output, possibly leading to XSS. Applications that use the HTML5 sanitizer and pass untrusted text to highlight, or to simple_format with html_options, are affected. This issue is fixed in versions 8.1.4.1 and 8.0.5.2.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-126079 since 11/10/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1059.007.

Upgrading to version 8.0.5.2 or 8.1.4.1 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• Rails

Name

• Action View

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion