ACTIVESUPPORT · GHSA-2w9f-fxwj-w2qf · Package
FIX → 8.1.4.1
ActiveSupport's MessagePack serializer restores a SafeBuffer that was mutated to be unsafe as html_safe. If that buffer holds untrusted input and is stored and later rendered, ERB auto-escaping is bypassed, which can lead to cross-site scripting.
first public Nov 4, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Applications on Rails 8.1 that use a MessagePack serializer for cookies, cache entries or message verifiers or encryptors, and that store a SafeBuffer modified in place with untrusted input. Rails 8.0 and earlier do not serialize SafeBuffer with MessagePack and are not affected. Apps using the default serializers can skip it.
Not affected if default-serializer, no-untrusted-safebuffer, rails-8.0-or-earlier
Who cares activesupport, rails, ruby, self-hosted
activesupport and confirm it is 8.1.x below 8.1.4.1cookies_serializer = :message_pack or :message_pack_allow_marshal, and serializer: :message_pack on Rails.cache, MessageVerifier or ActiveSupport::MessagePack serializes an ActiveSupport::SafeBuffer as its bytes alone and deserializes it as a new SafeBuffer, so a buffer that is no longer html_safe? (for example, one mutated in place with gsub!) is restored as html_safe. If such a buffer holds untrusted input and is stored through a MessagePack serializer, rendering it after it is loaded bypasses ERB auto-escaping, possibly leading to XSS.
Applications on Rails 8.1 are affected if they use a MessagePack serializer, such as config.action_dispatch.cookies_serializer = :message_pack or :message_pack_allow_marshal, or serializer: :message_pack for Rails.cache, ActiveSupport::MessageVerifier or ActiveSupport::MessageEncryptor, and store a that was mutated in place with untrusted input. Rails 8.0 and earlier do not serialize with MessagePack and are not affected.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
MessageEncryptorgsub!) before being written through one of those serializersUpgrade to 8.1.4.1
activesupport (rubygems) 8.1.4.1, for Rails 8.1 applicationsSafeBufferSafeBufferThe fixed releases serialize a SafeBuffer that is not html_safe? with a marker and deserialize it as a String; a SafeBuffer that is html_safe? keeps the existing format. Versions without the fix cannot read an unsafe buffer serialized by the fixed releases, so during a rolling deploy a cookie or cache entry holding one could fail to load on a process that has not been upgraded.
Applications that cannot upgrade can convert a SafeBuffer to a String with to_str before storing it in a value that a MessagePack serializer writes.
The fixed releases are available at the normal locations.
Patches for those who cannot upgrade at once:
This issue was responsibly reported by HackerOne researcher jcwilk.