Rails has a possible XSS vulnerability in its Action Pack debug exceptions
Published: March 23, 2026
SECURITY IDENTIFIERS
- CVE: CVE-2026-33167 (NVD)
- GHSA: GHSA-pgm4-439c-5jp6
- Vendor Advisory: https://github.com/rails/rails/security/advisories/GHSA-pgm4-439c-5jp6
GEM
FRAMEWORK
UNAFFECTED VERSIONS
< 8.1.0
PATCHED VERSIONS
>= 8.1.2.1
DESCRIPTION
Impact
The debug exceptions page does not properly escape exception messages.
A carefully crafted exception message could inject arbitrary HTML and JavaScript into the page, leading to XSS.
This affects applications with detailed exception pages enabled (config.consider_all_requests_local = true),
which is the default in development.
Releases
The fixed releases are available at the normal locations.