VDB
DEBIAN-CVE-2026-33168
DEBIAN-CVE-2026-33168
PUBLISHED
CVSS 2.299999952316284 LOW
Action View provides conventions and helpers for building web pages with the Rails framework. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, when a blank string is used as an HTML attribute name in Action View tag helpers, the attribute escaping is bypassed, producing malformed HTML. A carefully crafted attribute value could then be misinterpreted by the browser as a separate attribute name, possibly leading to XSS. Applications that allow users to specify custom HTML attributes are affected. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
Risk Scores
CVSS 4.0
2.299999952316284
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Debian:11 | rails | 7.2.3.1+dfsg, *, * |
| Debian:12 | rails | 6.1.7.3+dfsg, 6.1.7.10+dfsg, 6.1.7.3+dfsg |
| Debian:13 | rails | 2:7.2.2.1+dfsg-7, 2:7.2.3+dfsg-1, 2:7.2.3+dfsg-2 |
| Debian:14 | rails | 2:7.2.2.2+dfsg-2, 2:7.2.3+dfsg-2, 2:7.2.3+dfsg-3 |
Timeline
- Mar 23, 2026 CVE Published
- Apr 28, 2026 CVE Updated