{"id":"CVE-2026-33167","title":"Action Pack is a Rubygem for building web applications on the Rails framework","summary":"Action Pack is a Rubygem for building web applications on the Rails framework. In versions on the 8.1 branch prior to 8.1.2.1, the debug exceptions page does not properly escape exception messages. A carefully crafted exception message c…","severity":"medium","cvss":6.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","cwe":["CWE-79"],"vendor":"rubyonrails","product":"rails","affected":["rails >= 8.1.0, < 8.1.2.1"],"patched":["rails 8.1.2.1"],"published":"2026-03-23","updated":"2026-08-12","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-33167","references":[{"url":"https://github.com/rails/rails/commit/6752711c8c31d79ba50d13af6a6698a3b85415e0","label":"security-advisories@github.com"},{"url":"https://github.com/rails/rails/releases/tag/v8.1.2.1","label":"security-advisories@github.com"},{"url":"https://github.com/rails/rails/security/advisories/GHSA-pgm4-439c-5jp6","label":"security-advisories@github.com"}],"tags":["nvd"],"epss":0.0025,"epssPercentile":0.16729,"ingestedAt":"2026-08-12T19:54:26.835Z","slug":"CVE-2026-33167","body":"## Overview\n\nAction Pack is a Rubygem for building web applications on the Rails framework. In versions on the 8.1 branch prior to 8.1.2.1, the debug exceptions page does not properly escape exception messages. A carefully crafted exception message could inject arbitrary HTML and JavaScript into the page, leading to XSS. This affects applications with detailed exception pages enabled (`config.consider_all_requests_local = true`), which is the default in development. Version 8.1.2.1 contains a patch.\n\n## Affected\n\n- `rails >= 8.1.0, < 8.1.2.1`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `rails 8.1.2.1`","depth":"sunlit","depthScore":34,"depthScoreParts":{"impact":33.6,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}