LOW

GHSA-pgm4-439c-5jp6

Rails has a possible XSS vulnerability in its Action Pack debug exceptions

Details

### Impact The debug exceptions page does not properly escape exception messages. A carefully crafted exception message could inject arbitrary HTML and JavaScript into the page, leading to XSS. This affects applications with detailed exception pages enabled (`config.consider_all_requests_local = true`), which is the default in development.

### Releases The fixed releases are available at the normal locations.

### Credit This issue was responsibly reported by Hackerone researcher [fbettag](https://hackerone.com/fbettag).

Are you affected?

Enter the version of the package you're using.

Affected packages

RubyGems / actionpack

Introduced in: 8.1.0 Fixed in: 8.1.2.1

Fix bundle update actionpack

References

https://github.com/rails/rails/security/advisories/GHSA-pgm4-439c-5jp6 [WEB]
https://nvd.nist.gov/vuln/detail/CVE-2026-33167 [ADVISORY]
https://github.com/rails/rails/commit/6752711c8c31d79ba50d13af6a6698a3b85415e0 [WEB]
https://github.com/rails/rails [PACKAGE]
https://github.com/rails/rails/releases/tag/v8.1.2.1 [WEB]
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2026-33167.yml [WEB]