---
id: "GHSA-v6rj-xm57-3p59"
page: "https://infrastack.ai/live/GHSA-v6rj-xm57-3p59"
kind: "vulnerability"
aliases: ["GHSA-v6rj-xm57-3p59"]
title: "Possible XSS vulnerability in Action View highlight helper"
severity: "medium"
cvss: 6.1
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "actionview", "fixed": ["8.1.4.1"], "affected": ">= 8.1, < 8.1.4.1", "ecosystem": "rubygems"}, {"name": "actionview", "fixed": ["8.0.5.2"], "affected": "< 8.0.5.2", "ecosystem": "rubygems"}]
ecosystems: ["rubygems"]
tags: ["actionview", "cwe-79", "package", "rails", "ruby-on-rails", "self-hosted"]
not_affected_if: ["block-form", "default-highlighter", "element-content-only"]
published_at: "2026-11-04T03:02:12+00:00"
first_seen_at: "2026-11-09T22:53:29+00:00"
updated_at: "2026-11-09T22:55:05+00:00"
sources: [{"source": "ghsa-repo", "url": "https://github.com/rails/rails/security/advisories/GHSA-v6rj-xm57-3p59", "first_seen_at": "2026-11-09T22:53:29+00:00"}]
exploit_sources: []
---

# Possible XSS vulnerability in Action View highlight helper

Link for people: https://infrastack.ai/live/GHSA-v6rj-xm57-3p59 (this .md is for agents)

The Action View highlight helper inserts matched text into a custom :highlighter string without escaping and marks the result HTML-safe. An attacker who controls highlighted text can break out of a quoted attribute and add attributes to the element, leading to cross-site scripting.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- rubygems:actionview affected >= 8.1, < 8.1.4.1 fixed 8.1.4.1
- rubygems:actionview affected < 8.0.5.2 fixed 8.0.5.2

## How to check

- Search application code for `highlight(` calls that pass a `:highlighter` option.
- Check whether that highlighter places `\1` or another placeholder inside an attribute value, such as `<a href="...\1">`.
- Check the installed `actionview` version, e.g. `bundle exec gem list actionview`, against the fixed versions below.

## Fix

- actionview 8.1 series: `8.1.4.1`
- actionview 8.0 series: `8.0.5.2`
- Patches for those who cannot upgrade are linked in the advisory for 8.1 and 8.0.

## Timeline

- 2026-11-09T22:53:29+00:00 ghsa-repo https://github.com/rails/rails/security/advisories/GHSA-v6rj-xm57-3p59

## Documents

- [advisory] Maintainer's advisory: github.com https://github.com/rails/rails/security/advisories/GHSA-v6rj-xm57-3p59

## From the sources

### Impact
`ActionView::Helpers::TextHelper#highlight` substitutes each matched phrase into the `:highlighter` string without escaping it and returns the result marked HTML-safe. Because sanitizing leaves quote characters in text unescaped, a match substituted into a quoted attribute value of the highlighter, such as the `<a href="search?q=\1">` form shown in the method's documentation, could end the attribute value and add attributes to the element, possibly leading to XSS. Applications are affected when they pass a `:highlighter` that places a placeholder inside an attribute value and highlight text or phrases that a user controls. The default `<mark>\1</mark>` highlighter and the block form are not affected.

### Details
The fixed releases HTML-escape each group substituted into the `:highlighter` string, so quotes in a match are rendered as `&quot;` and `&#39;`. Only the numbered placeholders `\0` to `\9` are expanded; other `String#sub` replacement escapes, such as `\k<name>`, `\&` and `\\`, are left as written. A match can no longer begin on the `>` that closes a preceding tag. Escaping makes a placeholder safe as element content or inside a quoted attribute value, but not in an unquoted attribute value, a URL, JavaScript or CSS context, or an attribute whose value is HTML. See the Action View CHANGELOG for details.

### Workarounds
Use a `:highlighter` that places the matched phrase only in element content, such as the default `<mark>\1</mark>`.

### Releases
The fixed releases are available at the normal locations.

Patches for those who cannot upgrade at once:
- 8.1: https://github.com/rails/rails/commit/06938194b4fd59e1d2c8ab4a781f3c1e2b763425.patch
- 8.0: https://github.com/rails/rails/commit/c796f6198837479ada13290eb8fa767b5219a58a.patch

### Credit
This issue was found by the Anthropic OSS Scanner (ANT-2026-THHUJQVO).

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_