Impact
SafeBuffer#% does not propagate the @html_unsafe flag to the newly created buffer. If a SafeBuffer is mutated in place (e.g. via gsub!) and then formatted with % using untrusted arguments, the result incorrectly reports html_safe? == true, bypassing ERB auto-escaping and possibly leading to XSS.
Releases
The fixed releases are available at the normal locations.
- CVE-2026-33170
- GHSA-89vf-4333-qx8v
Versions affected
- activesupport >= 8.1, < 8.1.2.1 (patched in 8.1.2.1)
- activesupport >= 8.0, < 8.0.4.1 (patched in 8.0.4.1)
- activesupport < 7.2.3.1 (patched in 7.2.3.1)
Patches
- 8.1 - https://github.com/rails/rails/commit/50d732af3b7c8aaf63cbcca0becbc00279b215b7.patch
- 8.0 - https://github.com/rails/rails/commit/6e8a81108001d58043de9e54a06fca58962fc2db.patch
- 7.2 - https://github.com/rails/rails/commit/c1ad0e8e1972032f3395853a5e99cea035035beb.patch
Credit
This issue was responsibly reported by Seokchan Yoon (https://ch4n3.kr)