Staging Environment: Content and features may be unstable or change without notice.
Advisory details: ruby_advisory_db / gems/actionview/CVE-2026-33168
Advisory ID ruby_advisory_db/gems/actionview/CVE-2026-33168
Aliases CVE-2026-33168
GHSA-v55j-83pf-r9cq
Summary Rails has a possible XSS vulnerability in its Action View tag helpers ### Impact When a blank string is used as an HTML attribute name in Action View tag helpers, the attribute escaping is bypassed, producing malformed HTML. A carefully crafted attribute value could then be misinterpreted by the browser as a separate attribute name, possibly leading to XSS. Applications that allow users to specify custom HTML attributes are affected. ### Releases The fixed releases are available at the normal locations.
Status Published
Exploitability 0.5
Weighted Severity 0.0
Risk
Affected and Fixed Packages Package Details
Introduced and Fixed Package Commit Patches Package Commit Patches Details
Weaknesses (0)
There are no known CWE.
System Score Found at
cvssv4 2.3
Reference id Reference type URL
GHSA-v55j-83pf-r9cq https://github.com/rails/rails/security/advisories/GHSA-v55j-83pf-r9cq

No exploits are available.

No EPSS data available for this advisory.

Patch URL
There are no known patches.

There are no known vectors.

Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-03-24T13:36:28Z/

Decision: Track

Source URL: https://github.com/cisagov/vulnrichment/blob/develop/2026/33xxx/CVE-2026-33168.json

Source Advisory: vulnrichment/CVE-2026-33168

View SSVC decision tree 
[{'Exploitation': 'none'},
 {'Automatable': 'no'},
 {'Technical Impact': 'partial'},
 {'Mission Prevalence': 'minimal'},
 {'Public Well-being Impact': 'material'},
 {'Mission & Well-being': 'medium'}]