VDB
CVE-2026-33170
CVE-2026-33170
PUBLISHED
CVSS 5.300000190734863 MEDIUM
Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, `SafeBuffer#%` does not propagate the `@html_unsafe` flag to the newly created buffer. If a `SafeBuffer` is mutated in place (e.g. via `gsub!`) and then formatted with `%` using untrusted arguments, the result incorrectly reports `html_safe? == true`, bypassing ERB auto-escaping and possibly leading to XSS. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
EPSS 0.01% · 1.5th percentile
Risk Scores
CVSS v4.0
5.300000190734863
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS Score
0.01%
1.5th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| rubyonrails | rails | 0, 8.0.0, 8.1.0 |
| RubyGems | activesupport | 8.1.0.beta1, 8.0.0.beta1, 0 |
| rails | activesupport | >= 8.1.0.beta1, < 8.1.2.1, >= 8.0.0.beta1, < 8.0.4.1, < 7.2.3.1 |
| rails | activestorage | >= 8.1.0.beta1, < 8.1.2.1, >= 8.0.0.beta1, < 8.0.4.1, * |
Timeline
- Mar 23, 2026 CVE Published
- Mar 24, 2026 EPSS Score
- Mar 24, 2026 PoC Published
- Mar 24, 2026 Security Advisory
- Mar 25, 2026 EPSS Score
- Mar 25, 2026 Coalition ESS Score
- Apr 10, 2026 PoC Published
- Apr 10, 2026 PoC Published
- May 18, 2026 EPSS Score
- May 19, 2026 EPSS Score
- May 20, 2026 EPSS Score
- May 21, 2026 EPSS Score
References
- https://discuss.rubyonrails.org/t/cve-2026-33168-possible-xss-vulnerability-in-action-view-tag-helpers/90912 advisory
- https://discuss.rubyonrails.org/t/cve-2026-33169-possible-redos-vulnerability-in-number-to-delimited-in-active-support/90911 advisory
- https://discuss.rubyonrails.org/t/cve-2026-33170-possible-xss-vulnerability-in-safebuffer-in-active-support/90910 advisory
- https://discuss.rubyonrails.org/t/cve-2026-33167-possible-xss-vulnerability-in-action-pack-debug-exceptions/90913 advisory
- https://discuss.rubyonrails.org/t/cve-2026-33658-possible-dos-vulnerability-in-active-storage-proxy-mode-via-multi-range-requests/90906 advisory
- https://discuss.rubyonrails.org/t/cve-2026-33174-possible-dos-vulnerability-in-active-storage-proxy-mode-via-range-requests/90908 advisory
- https://discuss.rubyonrails.org/t/cve-2026-33202-possible-glob-injection-in-active-storage-diskservice/90903 advisory
- https://discuss.rubyonrails.org/t/cve-2026-33195-possible-path-traversal-in-active-storage-diskservice/90904 advisory
- https://discuss.rubyonrails.org/t/cve-2026-33173-insufficient-filtering-of-metadata-in-active-storage-direct-uploads/90909 advisory
- https://discuss.rubyonrails.org/t/cve-2026-33176-possible-dos-vulnerability-in-active-support-number-helpers/90907 advisory
- https://github.com/rails/rails/security/advisories/GHSA-73f9-jhhh-hr5m url
- https://github.com/rails/rails/commit/8c9676b803820110548cdb7523800db43bc6874c url
- https://github.com/rails/rails/commit/955284d26e469a9c026a4eee5b21f0414ab0bccf url
- https://github.com/rails/rails/commit/fa19073546360856e9f4dab221fc2c5d73a45e82 url
- https://github.com/rails/rails/releases/tag/v7.2.3.1 url
- https://github.com/rails/rails/releases/tag/v8.0.4.1 url
- https://github.com/rails/rails/releases/tag/v8.1.2.1 url
- https://github.com/rails/rails/security/advisories/GHSA-89vf-4333-qx8v url
- https://github.com/rails/rails/commit/50d732af3b7c8aaf63cbcca0becbc00279b215b7 url
- https://github.com/rails/rails/commit/6e8a81108001d58043de9e54a06fca58962fc2db url
…and 3 more