---
id: "GHSA-rq8q-p985-fjq7"
page: "https://infrastack.ai/live/GHSA-rq8q-p985-fjq7"
kind: "vulnerability"
aliases: ["GHSA-rq8q-p985-fjq7"]
title: "Possible XSS vulnerability in Action View strip_tags"
severity: "medium"
cvss: 6.1
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "actionview", "fixed": ["8.1.4.1"], "affected": ">= 8.1, < 8.1.4.1", "ecosystem": "rubygems"}, {"name": "actionview", "fixed": ["8.0.5.2"], "affected": "< 8.0.5.2", "ecosystem": "rubygems"}]
ecosystems: ["rubygems"]
tags: ["actionview", "cwe-79", "package", "rails", "ruby", "self-hosted"]
not_affected_if: ["element-content-only", "no-strip-tags-in-attributes", "tag-helper-for-attributes"]
published_at: "2026-11-04T03:02:09+00:00"
first_seen_at: "2026-11-09T22:53:29+00:00"
updated_at: "2026-11-09T22:55:06+00:00"
sources: [{"source": "ghsa-repo", "url": "https://github.com/rails/rails/security/advisories/GHSA-rq8q-p985-fjq7", "first_seen_at": "2026-11-09T22:53:29+00:00"}]
exploit_sources: []
---

# Possible XSS vulnerability in Action View strip_tags

Link for people: https://infrastack.ai/live/GHSA-rq8q-p985-fjq7 (this .md is for agents)

Action View's strip_tags marks its output html_safe while leaving double and single quotes unencoded. Untrusted input rendered inside a quoted HTML attribute can close the attribute and add new attributes, which can lead to cross-site scripting.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- rubygems:actionview affected >= 8.1, < 8.1.4.1 fixed 8.1.4.1
- rubygems:actionview affected < 8.0.5.2 fixed 8.0.5.2

## How to check

- Search application views and helpers for `strip_tags` whose output is placed inside an HTML attribute such as `title` or `<meta content>`.
- Check the installed Action View version with `bundle exec rails -v` or `bundle list actionview`; versions `>= 8.1, < 8.1.4.1` and `< 8.0.5.2` are affected.

## Fix

- Action View `8.1.4.1` for the 8.1 line.
- Action View `8.0.5.2` for the 8.0 line.
- Maintainer patches exist for 8.1 and 8.0 for teams that cannot upgrade yet.

## Timeline

- 2026-11-09T22:53:29+00:00 ghsa-repo https://github.com/rails/rails/security/advisories/GHSA-rq8q-p985-fjq7

## Documents

- [advisory] Maintainer's advisory: github.com https://github.com/rails/rails/security/advisories/GHSA-rq8q-p985-fjq7

## From the sources

### Impact
`strip_tags` in Action View returns its sanitized output marked `html_safe`, but the underlying sanitizer encodes only `&`, `<` and `>`, leaving `"` and `'` unencoded. Because ERB does not escape a string marked `html_safe`, untrusted input passed through `strip_tags` and rendered inside a quoted HTML attribute value could close the attribute and add new attributes, possibly leading to XSS. Applications that render `strip_tags` output from untrusted input inside an HTML attribute, for example in a `title` attribute or a `<meta content>` tag, are affected. Output rendered as element content is not affected.

### Details
`strip_tags` now encodes `"` and `'` in its output, as well as `&`, `<` and `>`, without double-encoding existing entities. Applications that use `strip_tags` output outside HTML, such as in a text template or JSON, now see `&quot;` and `&#39;` where they saw `"` and `'`; `CGI.unescapeHTML` decodes them. See the Action View CHANGELOG.

### Workarounds
Pass `strip_tags` output to an attribute through a tag helper, which escapes attribute values, for example `tag.a(title: strip_tags(user_input))`.

### Releases
The fixed releases are available at the normal locations.

Patches for those who cannot upgrade at once:
- 8.1: https://github.com/rails/rails/commit/568b19cb860322885593e308a7f27aceb779e9d7.patch
- 8.0: https://github.com/rails/rails/commit/c3772a10f405f9644125cbb484adfd2aa7a25a59.patch

### Credit
This issue was responsibly reported by HackerOne researcher [lucasluitjes](https://hackerone.com/lucasluitjes).

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_