ACTIONVIEW · GHSA-2p2f-4rq4-gjwc · Package
FIX → 8.1.4.1 +1
Action View's highlight and simple_format helpers can turn sanitized attribute values back into live markup when the HTML5 sanitizer is used, because Nokogiri serializes < and > unescaped. An attacker who supplies untrusted text to these helpers can inject elements that run script in a victim's browser.
first public Nov 4, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Applications built on Rails that use the HTML5 sanitizer (the default for apps with load_defaults 7.1 or later on CRuby) and pass untrusted text into highlight or simple_format with html_options. Apps that use the HTML4 sanitizer, or that do not feed untrusted text to these helpers, are not exposed.
Not affected if auth-required, html4-sanitizer, no-untrusted-input
Who cares actionview, rails, ruby, self-hosted
Gemfile.lock for actionview and whether it is below 8.1.4.1 or below 8.0.5.2.Gemfile.lock; it is affected if below 1.19.5.With the HTML5 sanitizer (Rails::HTML5::Sanitizer, the default vendor on CRuby for applications using load_defaults 7.1 or later), Nokogiri before 1.19.5 serializes < and > unescaped inside attribute values. The Action View text helpers highlight and simple_format sanitize their input and then process the resulting HTML as a string: highlight splits it on tag boundaries to insert matches, and simple_format splits it into paragraphs on blank lines. An unescaped > or a blank line inside an attribute value could cause markup in that value, which the sanitizer left inert, to be emitted as live elements in the helper's html_safe output, possibly leading to XSS. Applications that use the HTML5 sanitizer and pass untrusted text to highlight, or to simple_format with , are affected.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
load_defaults 7.1 or later with the default HTML5 sanitizer, and whether it passes untrusted text to highlight or simple_format with html_options.Upgrade to 8.1.4.1 +1
actionview 8.1 series: 8.1.4.1actionview 8.0 series: 8.0.5.21.19.5 or later (per the advisory, no Rails upgrade needed for this route)config.action_view.sanitizer_vendor = Rails::HTML4::Sanitizerhtml_optionsThe fixed releases require rails-html-sanitizer 1.7.2 or later, which requires Loofah 2.25.3 and Nokogiri 1.19.5. With these versions, the HTML5 sanitizer escapes < and > in attribute values as < and >, as the HTML4 sanitizer already does. The parsed DOM is unchanged, but code or tests that compare sanitized HTML as a string may see the new serialization.
Upgrade Nokogiri to 1.19.5 or later; the escaping is in its HTML5 serializer, so no Rails upgrade is needed. Alternatively, use the HTML4 sanitizer by setting config.action_view.sanitizer_vendor = Rails::HTML4::Sanitizer.
The fixed releases are available at the normal locations.
Patches for those who cannot upgrade at once:
This issue was responsibly reported by HackerOne researcher azaran. This issue was also found by the Anthropic OSS Scanner (ANT-2026-RTK47OH0).