Impact
The debug exceptions page does not properly escape exception messages. A carefully crafted exception message could inject arbitrary HTML and JavaScript into the page, leading to XSS. This affects applications with detailed exception pages enabled (config.consider_all_requests_local = true), which is the default in development.
Releases
The fixed releases are available at the normal locations.
- CVE-2026-33167
- GHSA-pgm4-439c-5jp6
Versions affected
- actionpack >= 8.1, < 8.1.2.1 (patched in 8.1.2.1)