Rails has a possible XSS vulnerability in its Action View tag helpers
Date: 2026-03
Affected: rubygems/actionview, rubygems/actionview, rubygems/actionview
Attack vector: xss
Category: vulnerability-disclosure
Severity: Low
CVE: CVE-2026-33168
CWE: CWE-79

### Impact When a blank string is used as an HTML attribute name in Action View tag helpers, the attribute escaping is bypassed, producing malformed HTML. A carefully crafted attribute value could then be misinterpreted by the browser as a separate attribute name, possibly leading to XSS. Applications that allow users to specify custom HTML attributes are affected. ### Releases The fixed releases are available at the normal locations. ### Credit This issue was responsibly reported by Hackerone researcher [taise](https://hackerone.com/taise).


Mitigations:

Architectural layers (MAESTRO):