LOW

GHSA-pgm4-439c-5jp6

Rails has a possible XSS vulnerability in its Action Pack debug exceptions

Quick fix

GHSA-pgm4-439c-5jp6 — actionpack: upgrade to the fixed version with the command below.

bundle update actionpack

Details

### Impact The debug exceptions page does not properly escape exception messages. A carefully crafted exception message could inject arbitrary HTML and JavaScript into the page, leading to XSS. This affects applications with detailed exception pages enabled (`config.consider_all_requests_local = true`), which is the default in development.

### Releases The fixed releases are available at the normal locations.

### Credit This issue was responsibly reported by Hackerone researcher [fbettag](https://hackerone.com/fbettag).

Are you affected?

Enter the version of the package you're using.

Affected packages

RubyGems/actionpack

Introduced in: 8.1.0Fixed in: 8.1.2.1

Fixbundle update actionpack

References

https://github.com/rails/rails/security/advisories/GHSA-pgm4-439c-5jp6[WEB]
https://nvd.nist.gov/vuln/detail/CVE-2026-33167[ADVISORY]
https://github.com/rails/rails/commit/6752711c8c31d79ba50d13af6a6698a3b85415e0[WEB]
https://github.com/rails/rails[PACKAGE]
https://github.com/rails/rails/releases/tag/v8.1.2.1[WEB]
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2026-33167.yml[WEB]