6.1

CVE-2026-33170: rails activesupport Cross-site Scripting

CVSS: 6.1v3.1MediumAnalyzed
AliasesUBUNTU-CVE-2026-33170DEBIAN-CVE-2026-33170CGA-2g8x-wc5h-m8x7
Published 23-03-2026Last modified 25-03-2026
Open JSON

Vulnerability summary

CVE-2026-33170 is a medium (CVSS 6.1) Cross-site Scripting vulnerability in rails activesupport. EPSS estimates a 0.33% chance of exploitation in the next 30 days, higher than 24.3% of scored vulnerabilities.

Overall risk
24/100
0100
Low · default modelHow is this calculated?
CVSS score
6.1/10
010
Medium · v3.1 (NVD)
EPSS score
0.33%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 0 · Related 1
CGA-W98X-3V9V-CP74

Timeline

  1. 23-03-2026
    PublishedVulnerability first disclosed.
  2. 25-03-2026
    Last modifiedVulnerability information updated.

Description

Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, `SafeBuffer#%` does not propagate the `@html_unsafe` flag to the newly created buffer. If a `SafeBuffer` is mutated in place (e.g. via `gsub!`) and then formatted with `%` using untrusted arguments, the result incorrectly reports `html_safe? == true`, bypassing ERB auto-escaping and possibly leading to XSS. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.

CVSS metrics

9 scores · 7 sources · 2 versions

EPSS trend

Probability

0.33%

Chance of exploitation in the next 30 days

Percentile

24%

Versus all other CVEs

30-day change

0.00 pp

From 0.33% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.33%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Chainguard29 products
  • cinc-auditor< 7.0.107-r1
  • gitlab-rails-ce-18.1All versions (No fix recorded)
  • gitlab-rails-ce-18.10< 18.10.3-r1
  • gitlab-rails-ce-18.2All versions (No fix recorded)
  • gitlab-rails-ce-18.3All versions (No fix recorded)
Wolfi4 products
  • cinc-auditor< 7.0.107-r1
  • kube-fluentd-operator< 1.18.2-r60
  • kube-logging-operator-fluentd-outputs< 6.4.0-r9
  • ruby3.2-rails-8.1< 8.1.3-r0
Debian1 product
  • rails< 2:6.1.7.10+dfsg-1~deb12u3 | < 2:7.2.2.2+dfsg-2~deb13u2 | < 2:7.2.3.1+dfsg-1
Rails1 product
  • activesupport≥ 8.1.0.beta1, < 8.1.2.1 | ≥ 8.0.0.beta1, < 8.0.4.1 | < 7.2.3.1
RubyGems1 product
  • activesupport≥ 8.1.0.beta1, < 8.1.2.1 | ≥ 8.0.0.beta1, < 8.0.4.1 | < 7.2.3.1
Rubyonrails1 product
  • rails< 7.2.3.1 | ≥ 8.0.0, < 8.0.4.1 | ≥ 8.1.0, < 8.1.2.1
Ubuntu1 product
  • railsAll versions (No fix recorded)

7 vendors · 38 products

References

14 links
Show all 14 references