CVE-2026-126078: Cross-Site Scripting in Ruby on Rails Action View highlight Helper

Action View is the template rendering and view generation framework within Ruby on Rails. It provides built-in view helper modules designed to construct HTML elements and format text while managing output encoding through Rails' ActiveSupport::SafeBuffer (html_safe) mechanism. Among these helpers, ActionView::Helpers::TextHelper#highlight locates specified phrases within a given block of text and wraps each occurrence in an HTML snippet.

In Rails versions prior to 8.0.5.2 and 8.1.4.1, ActionView::Helpers::TextHelper#highlight is vulnerable to Cross-Site Scripting (CWE-79). The method accepts an optional :highlighter string parameter that uses regex backreference syntax (such as \1) to interpolate the matched substring into custom HTML markup. After performing string substitution across non-tag text segments, the helper marks the resulting string as html_safe, bypassing subsequent automatic template escaping.

When an application configures a :highlighter template that places the \1 placeholder inside a quoted HTML attribute—a pattern previously demonstrated in the official Rails API documentation ('<a href="search?q=\1">\1</a>')—the matched substring is inserted directly into the attribute without escaping quotation characters. Although highlight sanitizes input text by default prior to substitution, HTML sanitization intentionally leaves literal double quotes (") and single quotes (') unescaped within plain text nodes.

Consequently, if an attacker controls the highlighted text or the search phrase and includes quotation marks, the substituted match terminates the quoted HTML attribute prematurely. The attacker can then inject arbitrary HTML attributes, such as onfocus, onclick, or onload event handlers, into the generated tag. This results in either Reflected or Stored Cross-Site Scripting depending on how the application sources the text and phrase arguments.

The root cause of CVE-2026-126078 stems from a context mismatch between HTML node sanitization and regex string replacement inside ActionView::Helpers::TextHelper#highlight, combined with an edge case in the regular expression used to tokenize HTML tags and text segments.

By default, highlight sanitizes the input text parameter using the sanitize helper unless sanitize: false is explicitly passed. HTML sanitization parses the input fragment, removes disallowed elements or attributes, and serializes the DOM tree back into an HTML string. During this serialization phase, literal quote characters (" and ') located inside text nodes do not require entity encoding to remain safe in an HTML element body context; in fact, Rails' sanitizer converts character references like " back into literal " characters.

Following sanitization, highlight splits the string into HTML tag starts and non-tag segments using text.scan(/<[^>]*|[^<]+/). For segments that do not start with <, the vulnerable implementation called Ruby's native String#gsub!(pattern, highlighter). When String#gsub! expands a backreference like \1, it copies the exact raw bytes of the captured text directly into the replacement string. If the :highlighter template places \1 inside an HTML attribute context (e.g., href="...\1..."), the unescaped " from the text node context transitions directly into a double-quoted attribute context without re-encoding, breaking the attribute boundary.

Additionally, the tokenization regex /<[^>]*|[^<]+/ exhibited a structural boundary defect. Because <[^>]* matches from < up to (but not including) the closing > of an HTML tag, the closing > character is captured as the very first character of the subsequent [^<]+ non-tag segment. If a user-supplied search phrase matched that leading > character, highlight replaced the tag's closing delimiter with the highlighter markup (or >), corrupting the surrounding HTML structure and turning subsequent text into attributes of the preceding HTML tag.

The vulnerability was remediated in commits 06938194b4fd59e1d2c8ab4a781f3c1e2b763425 (for the 8.1 / main branch) and c796f6198837479ada13290eb8fa767b5219a58a (for the 8.0 branch) within actionview/lib/action_view/helpers/text_helper.rb.

In the unpatched code, highlight iterated over the scanned segments and passed the highlighter string directly as the replacement argument to segment.gsub!:

# Vulnerable implementation in actionview/lib/action_view/helpers/text_helper.rb
patterns = Array(phrases).map { |phrase| Regexp === phrase ? phrase : Regexp.escape(phrase) }
pattern = /(#{patterns.join("|")})/i
highlighter = options.fetch(:highlighter, '<mark>\1</mark>') unless block
 
text.scan(/<[^>]*|[^<]+/).each do |segment|
  if !segment.start_with?("<")
    if block
      segment.gsub!(pattern, &block)
    else
      # FLAW 1: Direct unescaped substitution of backreferences (\1) into highlighter
      # FLAW 2: pattern can match the leading '>' closing the previous tag
      segment.gsub!(pattern, highlighter)
    end
  end
end.join

The patch modifies both the pattern matching boundaries and the replacement mechanism:

# Patched implementation in actionview/lib/action_view/helpers/text_helper.rb
patterns = Array(phrases).map { |phrase| Regexp === phrase ? phrase : Regexp.escape(phrase) }
pattern = /(#{patterns.join("|")})/i
 
# FIX 2: Negative lookahead prevents matching at the start of a segment that follows a tag,
# protecting the closing '>' character of the preceding HTML tag.
pattern_after_tag = /(?!\A)#{pattern}/
highlighter = options.fetch(:highlighter, '<mark>\1</mark>') unless block
 
text.scan(/<[^>]*|[^<]+/).each_with_index do |segment, index|
  if !segment.start_with?("<")
    segment_pattern = index > 0 ? pattern_after_tag : pattern
 
    if block
      segment.gsub!(segment_pattern, &block)
    else
      # FIX 1: Manually expand \0 through \9 and pass each capture group
      # through ERB::Util.html_escape_once to encode quotes and special characters.
      segment.gsub!(segment_pattern) do
        match = Regexp.last_match
        highlighter.gsub(/\\(\d)/) { ERB::Util.html_escape_once(match[$1.to_i]) }
      end
    end
  end
end.join

Fix Completeness Assessment

By switching from segment.gsub!(pattern, highlighter) to the block form of gsub!, the patched code intercepts Regexp.last_match and manually expands numbered placeholders \0 through \9. Each matched capture group is passed through ERB::Util.html_escape_once, which converts " to " and ' to ' without double-escaping existing HTML entities. Furthermore, pattern_after_tag = /(?!\A)#{pattern}/ ensures that any non-tag segment following an HTML tag (index > 0) cannot match at position \A (index 0, where the closing > resides).

> [!NOTE] > While the patch prevents breaking out of quoted HTML attributes and element bodies, ERB::Util.html_escape_once is not sufficient if an application places \1 inside an unquoted attribute, a javascript: URI scheme, an inline <script> or <style> block, or an HTML-interpreting attribute like srcdoc. The patch explicitly updates the method documentation to warn developers against placing placeholders in those contexts and replaces the <a href="search?q=\1"> documentation example with <mark title="\1">\1</mark>.

Exploiting CVE-2026-126078 requires an application to invoke highlight with three specific conditions:

1. The :highlighter option is set to a custom template containing a numbered backreference (\1, \0, etc.) inside a quoted HTML attribute (or a regex phrase match starts with > immediately after an HTML tag).
2. Either the text being highlighted or the phrases array being matched contains attacker-controlled input that permits matching a substring containing quotation marks (" or ').
3. The user views or interacts with the rendered HTML view.

Proof-of-Concept Analysis

Consider a search results template that uses the pattern previously shown in the official Rails documentation, where both the body content and search query reflect user input:

# Controller
@query = params[:q]
@article_snippet = "Showing results for: #{params[:q]}"
 
# View (ERB)
<%= highlight(@article_snippet, @query, highlighter: '<a href="/search?q=\1">\1</a>') %>

An attacker crafts a request with the following query parameter:

GET /search?q=rails%22%20onfocus=%22alert(document.domain)%22%20autofocus=%22 HTTP/1.1
Host: vulnerable-app.example.com

When highlight processes the input on an unpatched version of Rails:

1. sanitize(@article_snippet) executes. Because the input contains no HTML tags (< or >), the literal double quotes inside rails" onfocus="alert(document.domain)" autofocus=" remain unmodified.
2. Regexp.escape(@query) escapes the query for regex matching, matching the exact payload inside @article_snippet.
3. segment.gsub!(pattern, '<a href="/search?q=\1">\1</a>') substitutes the payload into \1.
4. The resulting HTML string is marked html_safe and rendered into the HTTP response:

Showing results for: <a href="/search?q=rails" onfocus="alert(document.domain)" autofocus="">rails" onfocus="alert(document.domain)" autofocus="</a>

When the victim's browser parses this markup, the href attribute closes right after rails. The browser interprets onfocus="alert(document.domain)" and autofocus="" as distinct attributes on the <a> element, automatically focusing the link on page load and executing the arbitrary JavaScript payload.

Tag Boundary Exploitation

In the secondary vector fixed by the patch, if text contains HTML tags (such as <span>text</span>) and the attacker controls phrases (passing >), the unpatched scanner split the string into ["<span", ">text", "</span", ">"]. Matching > on the second segment ">text" replaced the closing bracket of <span with <mark>></mark>text, producing malformed HTML <span<mark>></mark>text</span> and corrupting tag boundaries.

Successful exploitation of CVE-2026-126078 enables arbitrary JavaScript execution within the security context of the victim's browser session (Scope: Changed). The vulnerability carries a CVSS v3.1 Base Score of 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).

Once client-side script execution is achieved, an attacker can perform unauthorized actions on behalf of the authenticated user, bypass Cross-Site Request Forgery (CSRF) protections by reading the csrf-token meta tag from the DOM, exfiltrate sensitive information displayed on the page, or steal session identifiers if session cookies are not protected with the HttpOnly flag.

The scope of affected applications is constrained by configuration requirements. Applications that rely on the default :highlighter value ('<mark>\1</mark>') or pass a Ruby block to highlight (highlight(text, phrases) { |match| ... }) using standard Rails tag helpers are not vulnerable to the attribute injection vector. However, because the vulnerable '<a href="search?q=\1">\1</a>' pattern was explicitly included in the official Rails API documentation for TextHelper#highlight, applications where developers copied the documented example directly into production views are exposed.

According to FIRST EPSS metrics, CVE-2026-126078 currently holds an EPSS score of 0.00338 (0.34%, 27.57th percentile), and it is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

To remediate CVE-2026-126078, upgrade Ruby on Rails (rails and actionview gems) to the patched maintenance releases:

• Rails 8.1 Series: Upgrade to version 8.1.4.1 or later.
• Rails 8.0 Series: Upgrade to version 8.0.5.2 or later.

Update your application's Gemfile to specify the patched release version and run Bundler:

bundle update rails actionview

Workarounds and Secure Coding Practices

If an immediate framework upgrade cannot be deployed, developers can mitigate the vulnerability at the application layer by refactoring calls to highlight:

1. Use the Block Form with Tag Helpers: Replace string-based :highlighter options that construct links or attributes with the block syntax paired with link_to or content_tag (tag.*). Rails' tag helpers automatically enforce proper URL and attribute escaping:

# Vulnerable string-based highlighter:
highlight(text, query, highlighter: '<a href="search?q=\1">\1</a>')
 
# Secure block-based alternative:
highlight(text, query) do |match|
  link_to(match, search_path(q: match))
end

2. Avoid Non-HTML Contexts in :highlighter: Even after applying the patch, never place \1 inside href URLs without URL-encoding (which the block form handles via search_path), unquoted attributes, <script> tags, or inline event handlers. Restrict string-based :highlighter templates strictly to element text bodies (e.g., <mark>\1</mark>) or double-quoted data/text attributes (e.g., <mark title="\1">\1</mark>).