---
id: "GHSA-68p9-83h6-5wpj"
page: "https://infrastack.ai/live/GHSA-68p9-83h6-5wpj"
kind: "vulnerability"
aliases: ["GHSA-68p9-83h6-5wpj"]
title: "Possible XSS vulnerability in Action View tag helpers"
severity: "medium"
cvss: 4.7
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "actionview", "fixed": ["8.1.4.1"], "affected": ">= 8.1, < 8.1.4.1", "ecosystem": "rubygems"}, {"name": "actionview", "fixed": ["8.0.5.2"], "affected": "< 8.0.5.2", "ecosystem": "rubygems"}]
ecosystems: ["rubygems"]
tags: ["actionview", "cwe-79", "package", "rails", "ruby"]
not_affected_if: ["fixed-attribute-names", "no-user-attribute-names"]
published_at: "2026-11-04T03:02:03+00:00"
first_seen_at: "2026-11-09T22:53:29+00:00"
updated_at: "2026-11-09T22:57:08+00:00"
sources: [{"source": "ghsa-repo", "url": "https://github.com/rails/rails/security/advisories/GHSA-68p9-83h6-5wpj", "first_seen_at": "2026-11-09T22:53:29+00:00"}]
exploit_sources: []
---

# Possible XSS vulnerability in Action View tag helpers

Link for people: https://infrastack.ai/live/GHSA-68p9-83h6-5wpj (this .md is for agents)

Action View's tag helpers emit malformed HTML when an attribute name is whitespace only, because a blank-name check runs before the name is converted to a string. A crafted attribute value can then be read by a browser as a separate attribute, which may lead to cross-site scripting.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- rubygems:actionview affected >= 8.1, < 8.1.4.1 fixed 8.1.4.1
- rubygems:actionview affected < 8.0.5.2 fixed 8.0.5.2

## How to check

- Check the Rails version in `Gemfile.lock` for `actionview` and compare it with the fixed ranges.
- Search application code for user-controlled HTML attribute names passed to tag helpers such as `tag.div`, `content_tag`, `image_tag`, `video_tag` or `audio_tag`.

## Fix

- `actionview` 8.1.x: move to `8.1.4.1`
- `actionview` 8.0.x: move to `8.0.5.2`

## Timeline

- 2026-11-09T22:53:29+00:00 ghsa-repo https://github.com/rails/rails/security/advisories/GHSA-68p9-83h6-5wpj

## Documents

- [advisory] Maintainer's advisory: github.com https://github.com/rails/rails/security/advisories/GHSA-68p9-83h6-5wpj

## From the sources

### Impact
The fix for [CVE-2026-33168](https://github.com/rails/rails/security/advisories/GHSA-v55j-83pf-r9cq) skips blank HTML attribute names in Action View tag helpers, but it tests the name before converting it to a string. A Symbol name made only of whitespace, such as `:" "`, is not blank, because `Symbol#blank?` is `Symbol#empty?`, so it reaches the attribute escaping, which emits an attribute with no name and produces malformed HTML. The asset tag helpers, such as `image_tag`, `video_tag` and `audio_tag`, symbolize their options, so a whitespace String name passed to them takes the same path. A carefully crafted attribute value could then be misinterpreted by the browser as a separate attribute name, possibly leading to XSS. Applications that allow users to specify custom HTML attribute names are affected.

### Releases
The fixed releases are available at the normal locations.

Patches for those who cannot upgrade at once:
- 8.1: https://github.com/rails/rails/commit/9190210606ffe52f92fdc75637f8ff69404f22c8.patch
- 8.0: https://github.com/rails/rails/commit/f47452533e1f28d847c63181b9d5f8b7243ef9a4.patch

### Credit
This issue was responsibly reported by HackerOne researcher [thepo1es](https://hackerone.com/thepo1es).

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_