Rails has a possible XSS vulnerability in its Action Pack debug exceptions
Date: 2026-03
Affected: rubygems/actionpack
Attack vector: xss
Category: vulnerability-disclosure
Severity: Low
CVE: CVE-2026-33167
CWE: CWE-79

### Impact The debug exceptions page does not properly escape exception messages. A carefully crafted exception message could inject arbitrary HTML and JavaScript into the page, leading to XSS. This affects applications with detailed exception pages enabled (`config.consider_all_requests_local = true`), which is the default in development. ### Releases The fixed releases are available at the normal locations. ### Credit This issue was responsibly reported by Hackerone researcher [fbettag](https://hackerone.com/fbettag).


Mitigations:

Architectural layers (MAESTRO):