Skip to content
fr Sign in
5.3 Medium

CVE-2026-33170 Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework

Description

Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, `SafeBuffer#%` does not propagate the `@html_unsafe` flag to the newly created buffer. If a `SafeBuffer` is mutated in place (e.g. via `gsub!`) and then formatted with `%` using untrusted arguments, the result incorrectly reports `html_safe? == true`, bypassing ERB auto-escaping and possibly leading to XSS. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.

Affected products and versions

Product Affected versions Fixed in
ActiveSupport 8.1 8.1.0.beta1 → < 8.1.2.1 8.1.2.1
ActiveSupport 8.0 8.0.0.beta1 → < 8.0.4.1 8.0.4.1
ActiveSupport 7.2 earliest → < 7.2.3.1 7.2.3.1

References

Timeline

  1. Published
  2. Last modified

Other CVEs of ActiveSupport

The 5 CVEs of ActiveSupport →
CVE-2026-33176 Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework 6.6 Medium CVE-2026-33169 Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework 6.9 Medium CVE-2023-28120 There is a vulnerability in ActiveSupport if the new bytesplice method is called on a SafeBuffer with untrusted user… 5.3 Medium CVE-2023-38037 ActiveSupport::EncryptedFile writes contents that will be encrypted to a temporary file 5.5 Medium
Track this CVE