ACTIONVIEW · GHSA-68p9-83h6-5wpj · Package
FIX → 8.1.4.1 +1
Action View's tag helpers emit malformed HTML when an attribute name is whitespace only, because a blank-name check runs before the name is converted to a string. A crafted attribute value can then be read by a browser as a separate attribute, which may lead to cross-site scripting.
first public Nov 4, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Applications built on Rails that let users choose custom HTML attribute names for tag helpers are exposed, since a whitespace-only name reaches the attribute escaping code. Applications that only use fixed attribute names in their templates are not affected by this path. Teams that cannot upgrade immediately can apply the patch linked in the advisory.
Not affected if fixed-attribute-names, no-user-attribute-names
Who cares actionview, rails, ruby
Gemfile.lock for actionview and compare it with the fixed ranges.tag.div, content_tag, image_tag, video_tag or .The fix for CVE-2026-33168 skips blank HTML attribute names in Action View tag helpers, but it tests the name before converting it to a string. A Symbol name made only of whitespace, such as :" ", is not blank, because Symbol#blank? is Symbol#empty?, so it reaches the attribute escaping, which emits an attribute with no name and produces malformed HTML. The asset tag helpers, such as image_tag, video_tag and audio_tag, symbolize their options, so a whitespace String name passed to them takes the same path. A carefully crafted attribute value could then be misinterpreted by the browser as a separate attribute name, possibly leading to XSS. Applications that allow users to specify custom HTML attribute names are affected.
The fixed releases are available at the normal locations.
Patches for those who cannot upgrade at once:
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
audio_tagUpgrade to 8.1.4.1 +1
actionview 8.1.x: move to 8.1.4.1actionview 8.0.x: move to 8.0.5.2This issue was responsibly reported by HackerOne researcher thepo1es.