CVE-2026-33167
NoneCVSS
—
EPSS
0.3%
Published
Mar 23, 2026
CISA due date
—
The record
Action Pack is a Rubygem for building web applications on the Rails framework. In versions on the 8.1 branch prior to 8.1.2.1, the debug exceptions page does not properly escape exception messages. A carefully crafted exception message could inject arbitrary HTML and JavaScript into the page, leading to XSS. This affects applications with detailed exception pages enabled (`config.consider_all_requests_local = true`), which is the default in development. Version 8.1.2.1 contains a patch.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Chainguard | ruby3.2-rails-8.1 | 0 | 8.1.3-r0 |
| Wolfi | ruby3.2-rails-8.1 | 0 | 8.1.3-r0 |
Related vulnerabilities
- GHSA-53p3-c7vp-4mcc Trix is vulnerable to XSS through JSON deserialization bypass in drag-and-drop… Also affects ruby3.2-rails-8.1
- CVE-2026-33202 Active Storage allows users to attach cloud and local files in Rails applications. Also affects ruby3.2-rails-8.1
- CVE-2026-33170 Active Support is a toolkit of support libraries and Ruby core extensions extracted from… Also affects ruby3.2-rails-8.1
- CVE-2026-33173 Active Storage allows users to attach cloud and local files in Rails applications. Also affects ruby3.2-rails-8.1
- CVE-2026-33176 Active Support is a toolkit of support libraries and Ruby core extensions extracted from… Also affects ruby3.2-rails-8.1
- CVE-2026-33174 Active Storage allows users to attach cloud and local files in Rails applications. Also affects ruby3.2-rails-8.1
- CVE-2026-33169 Active Support is a toolkit of support libraries and Ruby core extensions extracted from… Also affects ruby3.2-rails-8.1
- CVE-2026-33195 Active Storage allows users to attach cloud and local files in Rails applications. Also affects ruby3.2-rails-8.1