ACTIONVIEW · GHSA-rq8q-p985-fjq7 · Package
FIX → 8.1.4.1 +1
Action View's strip_tags marks its output html_safe while leaving double and single quotes unencoded. Untrusted input rendered inside a quoted HTML attribute can close the attribute and add new attributes, which can lead to cross-site scripting.
first public Nov 4, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Applications that render strip_tags output from untrusted input inside an HTML attribute value, for example a title attribute or a meta content tag, are exposed. Output rendered as element content is not affected. Teams that use the tag helper for attribute values, as the advisory's workaround shows, are protected.
Not affected if element-content-only, no-strip-tags-in-attributes, tag-helper-for-attributes
Who cares actionview, rails, ruby, self-hosted
strip_tags whose output is placed inside an HTML attribute such as title or <meta content>.bundle exec rails -v or bundle list actionview; versions >= 8.1, < 8.1.4.1 and are affected.strip_tags in Action View returns its sanitized output marked html_safe, but the underlying sanitizer encodes only &, < and >, leaving " and ' unencoded. Because ERB does not escape a string marked html_safe, untrusted input passed through strip_tags and rendered inside a quoted HTML attribute value could close the attribute and add new attributes, possibly leading to XSS. Applications that render strip_tags output from untrusted input inside an HTML attribute, for example in a title attribute or a <meta content> tag, are affected. Output rendered as element content is not affected.
strip_tags now encodes and in its output, as well as , and , without double-encoding existing entities. Applications that use output outside HTML, such as in a text template or JSON, now see and where they saw and ; decodes them. See the Action View CHANGELOG.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
< 8.0.5.2Upgrade to 8.1.4.1 +1
8.1.4.1 for the 8.1 line.8.0.5.2 for the 8.0 line."'&<>strip_tags"'"'CGI.unescapeHTMLPass strip_tags output to an attribute through a tag helper, which escapes attribute values, for example tag.a(title: strip_tags(user_input)).
The fixed releases are available at the normal locations.
Patches for those who cannot upgrade at once:
This issue was responsibly reported by HackerOne researcher lucasluitjes.