~ / search / GHSA-pgm4-439c-5jp6

GHSA-pgm4-439c-5jp6

Rails has a possible XSS vulnerability in its Action Pack debug exceptions

Source: GitHub Advisory Database (reviewed) Low CVE-2026-33167

Packages

EcosystemPackageAffectedFixed in
RubyGems actionpack >= 8.1.0, < 8.1.2.1 8.1.2.1

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact The debug exceptions page does not properly escape exception messages. A carefully crafted exception message could inject arbitrary HTML and JavaScript into the page, leading to XSS. This affects applications with detailed exception pages enabled (`config.consider_all_requests_local = true`), which is the default in development. ### Releases The fixed releases are available at the normal locations. ### Credit This issue was responsibly reported by Hackerone researcher [fbettag](https://hackerone.com/fbettag).

References

External links from the advisory. They lead to third-party sites.