ACTIONVIEW · GHSA-v6rj-xm57-3p59 · Package
FIX → 8.1.4.1 +1
The Action View highlight helper inserts matched text into a custom :highlighter string without escaping and marks the result HTML-safe. An attacker who controls highlighted text can break out of a quoted attribute and add attributes to the element, leading to cross-site scripting.
first public Nov 4, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Applications that call Action View's highlight helper with a custom :highlighter that puts the placeholder inside an attribute value, and that highlight user-controlled text. The default <mark>\1</mark> highlighter and the block form are not affected, and neither is any use that keeps the placeholder in element content.
Not affected if block-form, default-highlighter, element-content-only
Who cares actionview, rails, ruby-on-rails, self-hosted
highlight( calls that pass a :highlighter option.\1 or another placeholder inside an attribute value, such as <a href="...\1">.actionview version, e.g. , against the fixed versions below.ActionView::Helpers::TextHelper#highlight substitutes each matched phrase into the :highlighter string without escaping it and returns the result marked HTML-safe. Because sanitizing leaves quote characters in text unescaped, a match substituted into a quoted attribute value of the highlighter, such as the <a href="search?q=\1"> form shown in the method's documentation, could end the attribute value and add attributes to the element, possibly leading to XSS. Applications are affected when they pass a :highlighter that places a placeholder inside an attribute value and highlight text or phrases that a user controls. The default <mark>\1</mark> highlighter and the block form are not affected.
The fixed releases HTML-escape each group substituted into the :highlighter string, so quotes in a match are rendered as " and '. Only the numbered placeholders \0 to \9 are expanded; other String#sub replacement escapes, such as , and , are left as written. A match can no longer begin on the that closes a preceding tag. Escaping makes a placeholder safe as element content or inside a quoted attribute value, but not in an unquoted attribute value, a URL, JavaScript or CSS context, or an attribute whose value is HTML. See the Action View CHANGELOG for details.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
bundle exec gem list actionviewUpgrade to 8.1.4.1 +1
8.1.4.18.0.5.2\k<name>\&\\>Use a :highlighter that places the matched phrase only in element content, such as the default <mark>\1</mark>.
The fixed releases are available at the normal locations.
Patches for those who cannot upgrade at once:
This issue was found by the Anthropic OSS Scanner (ANT-2026-THHUJQVO).