CVE-2026-126070: Cross-Site Scripting in Ruby on Rails Action View strip_tags Helper

Action View is the core Ruby on Rails framework component responsible for handling view template lookup, template rendering, and providing helpers for constructing HTML documents. Among these utilities is the SanitizeHelper module, which exposes methods such as sanitize, strip_links, and strip_tags to process untrusted user input before rendering it within application views.

A Cross-Site Scripting (XSS) vulnerability, tracked as CVE-2026-126070 (and GHSA-rq8q-p985-fjq7), exists in the strip_tags helper method in Ruby on Rails versions prior to 8.0.5.2 and 8.1.4.1. This flaw is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). The vulnerability stems from a discrepancy between the character encoding performed by the underlying HTML sanitizer and the safety guarantees expected of strings marked as html_safe in Rails.

When strip_tags processes a string, it removes HTML elements and encodes ampersands (&), less-than signs (<), and greater-than signs (>). However, it leaves single quotes (') and double quotes (") unencoded while marking the returned string as html_safe. Because the Rails ERB template engine bypasses automatic entity escaping for html_safe strings, interpolating the output of strip_tags directly inside a quoted HTML attribute allows untrusted input to prematurely close the attribute delimiter.

An attacker who controls input passed through strip_tags and rendered inside an HTML attribute (such as <meta content="...">, <input value="...">, or <div title="...">) can inject arbitrary HTML attributes, including inline JavaScript event handlers like onfocus or onmouseover. When triggered in a victim's browser, this results in arbitrary JavaScript execution within the context of the vulnerable application's origin.

To understand the root cause of CVE-2026-126070, it is necessary to examine how Ruby on Rails manages output safety during template compilation. Rails utilizes the ActiveSupport::SafeBuffer class (instantiated by calling .html_safe on a standard Ruby String) to distinguish between raw untrusted strings and strings that have already been sanitized or escaped. When an ERB template evaluates an expression using <%= ... %>, Rails inspects the return value: standard strings undergo full HTML entity escaping via ERB::Util.html_escape, whereas SafeBuffer instances are concatenated directly into the output buffer without further modification.

In Rails convention, any string marked as html_safe that is intended for general text interpolation must neutralize all five HTML-significant characters: &, <, >, ", and '. Neutralizing < and > prevents tag injection in element body contexts, while neutralizing " and ' prevents attribute breakout when the string is interpolated inside single- or double-quoted HTML attribute values.

Prior to the patch, ActionView::Helpers::SanitizeHelper#strip_tags delegated sanitization to rails-html-sanitizer via self.class.full_sanitizer.sanitize(html) and immediately invoked &.html_safe on the result. The full_sanitizer (backed by Loofah and Nokogiri) parses the input as an HTML fragment, strips all element nodes, and serializes the remaining text nodes. During text node serialization, Nokogiri/Loofah encodes &, <, and > into &, <, and > respectively, as required by the HTML specification for element content. Because quotation marks are completely valid inside HTML text nodes, the serializer leaves " and ' as literal characters.

By unconditionally appending .html_safe to the output of full_sanitizer.sanitize, strip_tags promoted a string that was only safe for element content into a SafeBuffer that ERB treated as safe for all HTML contexts, including quoted attribute values. When a developer wrote <div title="<%= strip_tags(untrusted_input) %>">, ERB observed the SafeBuffer flag, skipped attribute escaping, and emitted the unescaped quotation marks directly into the rendered HTML document.

The vulnerability resides in actionview/lib/action_view/helpers/sanitize_helper.rb. In vulnerable versions of Rails, strip_tags was implemented as a single-line method that called full_sanitizer.sanitize and marked any non-nil return value as html_safe.

# Vulnerable implementation in actionview/lib/action_view/helpers/sanitize_helper.rb
def strip_tags(html)
  self.class.full_sanitizer.sanitize(html)&.html_safe
end

In commits 568b19cb860322885593e308a7f27aceb779e9d7 and c3772a10f405f9644125cbb484adfd2aa7a25a59, the Rails core team modified strip_tags to pass the sanitized string through ERB::Util.html_escape_once rather than calling .html_safe directly.

diff --git a/actionview/lib/action_view/helpers/sanitize_helper.rb b/actionview/lib/action_view/helpers/sanitize_helper.rb
--- a/actionview/lib/action_view/helpers/sanitize_helper.rb
+++ b/actionview/lib/action_view/helpers/sanitize_helper.rb
@@ -1,5 +1,6 @@
 # frozen_string_literal: true
 
+require "active_support/core_ext/string/output_safety"
 require "rails-html-sanitizer"
 
 module ActionView
@@ -33,6 +34,9 @@ module SanitizeHelper
       # Please note that sanitizing user-provided text does not guarantee that the
       # resulting markup is valid or even well-formed.
       #
+      # The output is markup, which is safe only as element content. Do not use it in an attribute
+      # value; use +strip_tags+ or a tag helper such as <tt>tag.a(title: ...)</tt> instead.
+      #
       # ==== Options
       #
       # [+:tags+]
@@ -137,7 +141,8 @@ def sanitize_css(style)
       #   strip_tags("> A quote from Smith & Wesson")
       #   # => &gt; A quote from Smith &amp; Wesson
       def strip_tags(html)
-        self.class.full_sanitizer.sanitize(html)&.html_safe
+        stripped = self.class.full_sanitizer.sanitize(html)
+        ERB::Util.html_escape_once(stripped) if stripped
       end

The replacement of &.html_safe with ERB::Util.html_escape_once(stripped) resolves the issue through two specific mechanisms:

1. Complete Character Encoding: html_escape_once converts " to " and ' to ' while also ensuring &, <, and > are encoded. Because full_sanitizer.sanitize already converts &, <, and > into &, <, and >, using html_escape_once (instead of standard html_escape) prevents double-encoding existing HTML entities (e.g., avoiding &).
2. SafeBuffer Return Type: ERB::Util.html_escape_once returns an ActiveSupport::SafeBuffer instance, preserving backward compatibility with callers that expect strip_tags to return an html_safe string.

Fix Completeness and Variant Analysis: The patch also updates the documentation for the sibling sanitize helper to explicitly warn developers that sanitize returns markup intended strictly for element content and must not be placed inside HTML attributes. Because sanitize intentionally allows HTML tags and attributes through an allowlist, encoding quotes across its entire return string would break allowed HTML tag attributes. Furthermore, strip_tags remains unsafe if placed inside an unquoted HTML attribute (e.g., <div title=<%= strip_tags(input) %>>), as whitespace characters are sufficient to break out of unquoted attributes. However, unquoted dynamic attributes violate standard HTML authoring practices regardless of the escaping function used.

Exploiting CVE-2026-126070 requires an application to accept untrusted input, pass that input through strip_tags, and interpolate the result directly inside a quoted HTML attribute within an ERB template. Common real-world patterns where developers use strip_tags inside attributes include populating SEO <meta> tags, tooltip title attributes, data-* attributes, or form <input value="..."> fields from user-generated rich text or Markdown summaries.

Consider a vulnerable Rails ERB template that renders user-supplied profile data or article summaries inside a <meta> tag and an <input> field:

<!-- Vulnerable ERB Template -->
<meta name="description" content="<%= strip_tags(@user.bio) %>">
<input type="text" name="headline" value="<%= strip_tags(@user.headline) %>">

Because the attacker cannot use < or > to close the enclosing tag or inject a <script> block (as full_sanitizer.sanitize strips tags and encodes angle brackets), exploitation relies on attribute injection. If the target element is an interactive form control such as <input>, the attacker can supply the following payload for @user.headline:

x" onfocus="alert(document.domain)" autofocus="

When strip_tags executes on this payload, full_sanitizer detects no HTML tags or angle brackets and returns the string unmodified, marked as html_safe. ERB inserts the string directly into the value attribute:

<input type="text" name="headline" value="x" onfocus="alert(document.domain)" autofocus="">

When the page loads in the victim's browser, the autofocus attribute immediately directs browser focus to the <input> element, firing the onfocus event handler and executing the attacker's JavaScript without requiring direct user clicks.

If the target element is non-interactive by default (such as a <div> with a title attribute) or a hidden element that can be styled to become visible and interactive, the attacker can combine inline style attributes with mouse event handlers:

x" onmouseover="alert(document.domain)" style="position:fixed;top:0;left:0;width:100vw;height:100vh;z-index:9999;" x="

When rendered inside <div title="<%= strip_tags(input) %>">, this payload breaks out of the title attribute, overlays the element across the entire browser viewport using fixed CSS positioning, and executes the onmouseover payload as soon as the user moves their cursor anywhere on the page.

CVE-2026-126070 is rated as Medium severity with a CVSS v3.1 base score of 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). The attack vector is Network (AV:N) with Low attack complexity (AC:L) and requires no privileges (PR:N) in scenarios where unauthenticated input (such as search queries, public comments, or URL parameters) is reflected or stored. User Interaction is Required (UI:R), as a victim must view the rendered page or interact with the injected element. The Scope is Changed (S:C) because the vulnerability resides in the server-side web framework but executes within the security context of the client browser.

Successful exploitation grants the attacker arbitrary JavaScript execution in the victim's browser session within the origin of the vulnerable Rails application. Depending on the application's architecture and session management configuration, an attacker can:

• Perform unauthorized actions on behalf of the authenticated user by issuing forged fetch or XMLHttpRequest calls, bypassing Cross-Site Request Forgery (CSRF) protections by reading the <meta name="csrf-token"> directly from the DOM.
• Exfiltrate sensitive data rendered within the DOM or accessible via authenticated API endpoints.
• Steal session identifiers or authentication tokens if they are stored in localStorage, sessionStorage, or cookies lacking the HttpOnly flag.

Applications that only render strip_tags output as standard HTML element content (e.g., <p><%= strip_tags(user_input) %></p>) are not affected, because < and > were already properly encoded into < and > by the sanitizer. Furthermore, applications that pass strip_tags output into Rails tag builder helpers (such as tag.div(title: strip_tags(input)) or content_tag) are confirmably unaffected or have reduced exposure depending on how attribute hashes are escaped.

According to threat intelligence data, CVE-2026-126070 has an EPSS score of 0.00269 (19.25th percentile), indicating a low probability of widespread automated exploitation within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no weaponized exploits or mass-scanning templates have been observed in the wild.

To remediate CVE-2026-126070, upgrade Ruby on Rails (rails / actionview gems) to a patched release that encodes quotation marks in strip_tags output:

• For Rails 8.0.x, upgrade to 8.0.5.2 or later.
• For Rails 8.1.x, upgrade to 8.1.4.1 or later.

Update the Gemfile to specify the patched version and run bundle update rails:

# Gemfile
gem "rails", "~> 8.1.4", ">= 8.1.4.1"
# or for the 8.0 branch:
gem "rails", "~> 8.0.5", ">= 8.0.5.2"

> [!NOTE] > Behavioral Change in Non-HTML Contexts: Because strip_tags now encodes " and ' as " and ', applications that use strip_tags to clean strings for non-HTML outputs—such as plain-text emails, JSON API payloads, or CSV exports—will now see HTML entity strings where literal quotation marks previously appeared. If plain text is required after stripping tags, wrap the call in CGI.unescapeHTML(strip_tags(input)) and ensure the resulting plain string is not marked html_safe.

If an immediate framework upgrade is not feasible, apply one of the following code-level mitigations in ERB templates:

1. Explicitly call html_escape_once when interpolating inside HTML attributes:

   <meta name="description" content="<%= html_escape_once(strip_tags(user_input)) %>">
   <div title="<%= html_escape_once(strip_tags(user_input)) %>">Content</div>

2. Use Rails tag helpers instead of raw HTML attribute interpolation:

   <%= tag.meta(name: "description", content: html_escape_once(strip_tags(user_input))) %>

3. Audit for unquoted attributes and improper sanitize usage: Ensure all HTML attributes containing dynamic content are enclosed in single or double quotes, and verify that the output of sanitize(...) (which permits HTML markup) is never interpolated inside an HTML attribute value.