# \[CVE-2026-33167\] Possible XSS vulnerability in Action Pack debug exceptions

**URL:** <https://discuss.rubyonrails.org/t/cve-2026-33167-possible-xss-vulnerability-in-action-pack-debug-exceptions/90913>\
**Category:** Security Announcements\
**Tags:** announcement, security\
**Created:** [March 23, 2026, 9:26pm UTC](https://discuss.rubyonrails.org/t/cve-2026-33167-possible-xss-vulnerability-in-action-pack-debug-exceptions/90913 "2026-03-23T21:26:10Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![jhawthorn](https://sea2.discourse-cdn.com/rubyonrails/user_avatar/discuss.rubyonrails.org/jhawthorn/32/590_2.png) [@jhawthorn](https://discuss.rubyonrails.org/u/jhawthorn)\
**Post date:** [March 23, 2026, 9:26pm UTC](https://discuss.rubyonrails.org/t/cve-2026-33167-possible-xss-vulnerability-in-action-pack-debug-exceptions/90913/1 "2026-03-23T21:26:10Z")

</div>

### Impact

The debug exceptions page does not properly escape exception messages. A carefully crafted exception message could inject arbitrary HTML and JavaScript into the page, leading to XSS. This affects applications with detailed exception pages enabled (`config.consider_all_requests_local = true`), which is the default in development.

### Releases

The fixed releases are available at the normal locations.

- CVE-2026-33167
- GHSA-pgm4-439c-5jp6

## Versions affected

- actionpack \>= 8.1, \< 8.1.2.1 (patched in 8.1.2.1)

## Patches

- 8.1 - [https://github.com/rails/rails/commit/6752711c8c31d79ba50d13af6a6698a3b85415e0.patch](https://github.com/rails/rails/commit/6752711c8c31d79ba50d13af6a6698a3b85415e0.patch)