CVE-2026-33170
MediumCVSS 6.1Summary
In Active Support (Ruby on Rails), SafeBuffer#% does not propagate the @html_unsafe flag to the newly created buffer. If a SafeBuffer is mutated in place (e.g., via gsub!) and then formatted with % using untrusted arguments, the result incorrectly reports html_safe? == true, bypassing ERB auto-escaping and possibly leading to XSS.
Risk Assessment
May allow an attacker to inject script (XSS) in Rails applications that format mutated SafeBuffer with untrusted data.
Recommendation
Update the Active Support gem to version 8.1.2.1, 8.0.4.1, or 7.2.3.1 (or later).
Other vulnerabilities in Active Support
See all- CVE-2026-33176High
Active Support (a Ruby library from Rails) before versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 accepts strings in scientific notation (e.g. 1e10000) in number helpers, which BigDecimal expands into extremely large decimals. Formatting such a number causes excessive memory allocation and CPU consumption.
- CVE-2026-33169Medium
Active Support is a Ruby support library extracted from the Rails framework. NumberToDelimitedConverter uses a lookahead-based regular expression with gsub!, which can cause quadratic time complexity on long digit strings. The issue is patched in versions 8.1.2.1, 8.0.4.1, and 7.2.3.1.
- CVE-2023-22796High
A regular expression based DoS vulnerability in Active Support <6.1.7.1 and <7.0.4.1. A specially crafted string passed to the underscore method can cause the regular expression engine to enter catastrophic backtracking, causing the process to use large amounts of CPU and memory.
Original NVD description (English source)
Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, `SafeBuffer#%` does not propagate the `@html_unsafe` flag to the newly created buffer. If a `SafeBuffer` is mutated in place (e.g. via `gsub!`) and then formatted with `%` using untrusted arguments, the result incorrectly reports `html_safe? == true`, bypassing ERB auto-escaping and possibly leading to XSS. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS