- Severity: MEDIUM
- CVE: CVE-2026-126070
- Ecosystems: rubygems, rubygems
- Packages: actionview, actionview
### Impact
`strip_tags` in Action View returns its sanitized output marked `html_safe`, but the underlying sanitizer encodes only `&`, “, leaving `”` and `’` unencoded. Because ERB does not escape a string marked `html_safe`, untrusted input passed through `strip_tags` and rendered inside a quoted HTML attribute value could close the attribute and add new attributes, possibly leading to XSS. Applications that render `strip_tags` output from untrusted input inside an HTML attribute, for example in a `title` attribute or a “ tag, are affected. Output rendered as element content is not affected.
### Details
`strip_tags` now encodes `”` and `’` in its output, as well as `&`, “, without double-encoding existing entities. Applications that use `strip_tags` output outside HTML, such as in a text template or JSON, now see `”` and `’` where they saw `”` and `’`; `CGI.unescapeHTML` decodes them. See the Action View CHANGELOG.
### Workarounds
Pass `strip_tags` output to an attribute through a tag helper, which escapes attribute values, for example `tag.a(title: strip_tags(user_input))`.
### Releases
The fixed releases are available at the normal locations.
Patches for those who cannot upgrade at once:
– 8.1: https://github.com/rails/rails/commit/568b19cb860322885593e308a7f27aceb779e9d7.patch
– 8.0: https://github.com/rails/rails/commit/c3772a10f405f9644125cbb484adfd2aa7a25a59.patch
### Credit
This issue was responsibly reported by HackerOne researcher [lucasluitjes](htt…
Source: GitHub Security Advisories · 2026-11-12