- Severity: MEDIUM
- CVE: CVE-2026-126078
- Ecosystems: rubygems, rubygems
- Packages: actionview, actionview
### Impact
`ActionView::Helpers::TextHelper#highlight` substitutes each matched phrase into the `:highlighter` string without escaping it and returns the result marked HTML-safe. Because sanitizing leaves quote characters in text unescaped, a match substituted into a quoted attribute value of the highlighter, such as the “ form shown in the method’s documentation, could end the attribute value and add attributes to the element, possibly leading to XSS. Applications are affected when they pass a `:highlighter` that places a placeholder inside an attribute value and highlight text or phrases that a user controls. The default `\1` highlighter and the block form are not affected.
### Details
The fixed releases HTML-escape each group substituted into the `:highlighter` string, so quotes in a match are rendered as `”` and `’`. Only the numbered placeholders `\0` to `\9` are expanded; other `String#sub` replacement escapes, such as `\k`, `\&` and `\\`, are left as written. A match can no longer begin on the `>` that closes a preceding tag. Escaping makes a placeholder safe as element content or inside a quoted attribute value, but not in an unquoted attribute value, a URL, JavaScript or CSS context, or an attribute whose value is HTML. See the Action View CHANGELOG for details.
### Workarounds
Use a `:highlighter` that places the matched phrase only in element content, such as the default `\1`.
### Releases
The fixed releases are available at the normal locations.
Patc…
Source: GitHub Security Advisories · 2026-11-12