Medium
Rails Active Support has a possible XSS vulnerability in SafeBuffer#%
Type: advisorySources: OSV
Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, `SafeBuffer#%` does not propagate the `@html_unsafe` flag to the newly created buffer. If a `SafeBuffer` is mutated in place (e.g. via `gsub!`) and then formatted with `%` using untrusted arguments, the result incorrectly reports `html_safe? == true`, bypassing ERB auto-escaping and possibly leading to XSS. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-33170
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 3 Nov 2026, 05:45 UTC · Revision 1
Source evidence
Rails Active Support has a possible XSS vulnerability in SafeBuffer#%
core-osv · Original sourcePublished 23 Mar 2026, 23:09 UTC
Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, `SafeBuffer#%` does not propagate the `@html_unsafe` flag to the newly created buffer. If a `SafeBuffer` is mutated in place (e.g. via `gsub!`) and then formatted with `%` using untrusted arguments, the result incorrectly reports `html_safe? == true`, bypassing ERB auto-escaping and possibly leading to XSS. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
osv:CVE-2026-33170
Complete source record
{
"id": "20ee37384bd134e7390938e39cf3643774321c2a4abe8a87daa166711ea94b44",
"url": "https://osv.dev/vulnerability/CVE-2026-33170",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Rails Active Support has a possible XSS vulnerability in SafeBuffer#%",
"summary": "Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, `SafeBuffer#%` does not propagate the `@html_unsafe` flag to the newly created buffer. If a `SafeBuffer` is mutated in place (e.g. via `gsub!`) and then formatted with `%` using untrusted arguments, the result incorrectly reports `html_safe? == true`, bypassing ERB auto-escaping and possibly leading to XSS. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.",
"evidence": "osv:CVE-2026-33170",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2026-33170",
"aliases": [
"CVE-2026-33170",
"GHSA-89vf-4333-qx8v"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/rails/rails",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "ba76fca032a66f3716ca8a661c9ddb006acaf885"
},
{
"introduced": "dd8f7185faeca6ee968a6e9367f6d8601a83b8db"
},
{
"fixed": "a79efed95797b196575a98845dc989e3106a9acb"
},
{
"introduced": "1cdd190a25e483b65f1f25bbd0f13a25d696b461"
},
{
"fixed": "1db4b89687cc18311fc3f92623136705df24e671"
},
{
"fixed": "50d732af3b7c8aaf63cbcca0becbc00279b215b7"
},
{
"fixed": "6e8a81108001d58043de9e54a06fca58962fc2db"
},
{
"fixed": "c1ad0e8e1972032f3395853a5e99cea035035beb"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:rubyonrails:rails:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "7.2.3.1"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:rubyonrails:rails:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "8.0.0"
},
{
"fixed": "8.0.4.1"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:rubyonrails:rails:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "8.1.0"
},
{
"fixed": "8.1.2.1"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "50d732af3b7c8aaf63cbcca0becbc00279b215b7"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "6e8a81108001d58043de9e54a06fca58962fc2db"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "c1ad0e8e1972032f3395853a5e99cea035035beb"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "ba76fca032a66f3716ca8a661c9ddb006acaf885"
}
],
"source": "REFERENCES_TAG",
"original_tag": "v7.2.3.1"
},
{
"range": [
{
"fixed": "a79efed95797b196575a98845dc989e3106a9acb"
}
],
"source": "REFERENCES_TAG",
"original_tag": "v8.0.4.1"
},
{
"range": [
{
"fixed": "1db4b89687cc18311fc3f92623136705df24e671"
}
],
"source": "REFERENCES_TAG",
"original_tag": "v8.1.2.1"
}
]
}
}
],
"versions": [
"v7.2.3",
"v8.0.4",
"v8.1.2",
"v8.1.1",
"v8.1.0",
"v8.0.3",
"v8.0.2",
"v8.0.1",
"v8.0.0",
"v7.2.2",
"v7.2.1",
"v7.2.0.rc1",
"v7.2.0.beta3",
"v7.2.0.beta2",
"v7.2.0.beta1",
"v7.1.0.beta1",
"v7.0.0.alpha2",
"v7.0.0.alpha1",
"v6.1.0.rc1",
"v6.0.0.beta2",
"v6.0.0.beta1",
"v5.1.0.beta1",
"v5.0.0.beta4",
"v5.0.0.beta2",
"v5.0.0.beta1",
"v4.2.0.beta1",
"v4.0.0.rc1",
"v4.0.0.beta1",
"v3.2.0.rc1",
"v3.1.0.rc1",
"v3.1.0.beta1",
"v3.0.0.beta3",
"v3.0.0.beta.3",
"v2.0.1",
"v2.0.0",
"v2.0.0_RC2",
"v2.0.0_RC1",
"v2.0.0_PR",
"v1.1.1",
"v1.1.0",
"v1.1.0_RC1",
"v0.14.3",
"v0.14.1",
"v0.13.1",
"v0.13.0",
"v0.12.0",
"v0.11.1",
"v0.11.0",
"v0.10.1",
"v0.10.0",
"v0.9.5",
"v0.9.4.1",
"v0.9.4",
"v0.9.3",
"v0.9.2",
"v0.9.1"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-33170.json"
}
}
],
"modified": "2026-10-28T02:30:26.478679521Z",
"provider": "osv",
"references": [
"https://github.com/rails/rails/releases/tag/v7.2.3.1",
"https://github.com/rails/rails/releases/tag/v8.0.4.1",
"https://github.com/rails/rails/releases/tag/v8.1.2.1",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33170.json",
"https://github.com/rails/rails/security/advisories/GHSA-89vf-4333-qx8v",
"https://nvd.nist.gov/vuln/detail/CVE-2026-33170",
"https://github.com/rails/rails/commit/50d732af3b7c8aaf63cbcca0becbc00279b215b7",
"https://github.com/rails/rails/commit/6e8a81108001d58043de9e54a06fca58962fc2db",
"https://github.com/rails/rails/commit/c1ad0e8e1972032f3395853a5e99cea035035beb"
],
"provider_metadata": {
"cwe_ids": [
"CWE-79"
],
"cna_assigner": "GitHub_M",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33170.json"
}
},
"related_cves": [
{
"value": "CVE-2026-33170",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 492810,
"published_at": "2026-03-23T23:09:48.923+00:00"
}