CVE-2026-126079: 
Ruby vulnerability analysis and mitigation

CVE-2026-126079 is a Cross-Site Scripting (XSS) vulnerability in Ruby on Rails' Action View framework, specifically affecting the highlight and simple_format text helper methods when used with the HTML5 sanitizer (Rails::HTML5::Sanitizer). The vulnerability stems from Nokogiri (before version 1.19.5) serializing < and > characters unescaped inside HTML attribute values, which can cause sanitized-but-inert markup within attribute values to be emitted as live HTML elements. Affected versions are Rails < 8.0.5.2 and Rails >= 8.1, < 8.1.4.1 (on CRuby with load_defaults 7.1 or later). It carries a CVSS v3.1 base score of 6.1 (Medium) (GitHub Advisory). The vulnerability was responsibly reported by HackerOne researcher azaran and also independently discovered by the Anthropic OSS Scanner (ANT-2026-RTK47OH0), with the advisory published on November 4, 2026 (GitHub Advisory).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). The HTML5 sanitizer (Rails::HTML5::Sanitizer) relies on Nokogiri for HTML parsing and serialization; versions of Nokogiri prior to 1.19.5 do not escape < and > characters when serializing attribute values. The highlight helper splits sanitized HTML on tag boundaries to insert match highlights, and simple_format splits on blank lines to create paragraphs — both operate on the sanitized HTML as a raw string. If an attribute value contains an unescaped > or a blank line, markup that the sanitizer had rendered inert (e.g., <img onerror=...> inside an attribute) can be reinterpreted as live HTML elements in the html_safe output, enabling XSS. The attack requires an attacker to supply untrusted input to highlight or to simple_format with html_options, and a victim user must view the rendered page (GitHub Advisory, Patch Commit 8.0).

Successful exploitation allows an attacker to inject and execute arbitrary JavaScript in the context of a victim user's browser session, leading to low-level confidentiality and integrity impacts (e.g., session token theft, credential harvesting, or UI redressing). Availability is not directly impacted. The scope is changed, meaning the vulnerability in the Rails application component can affect the security context of the end user's browser. Applications that render user-supplied content through highlight or simple_format with html_options using the default HTML5 sanitizer on CRuby (Rails 7.1+ defaults) are at risk (GitHub Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the advisory date. The EPSS score is 0.0, indicating very low current exploitation probability (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires user interaction (a victim must view a page rendering attacker-controlled input), and the attack vector is network-based with no privileges required (GitHub Advisory).

1. Identify a target: Find a Rails application (CRuby, load_defaults 7.1 or later) that passes untrusted user input to the highlight or simple_format (with html_options) Action View helpers and renders the output to other users.
2. Craft malicious input: Construct input containing HTML markup embedded inside an attribute value that includes an unescaped > character or a blank line, such as: <a title="foo><img src=x onerror=alert(1)>">text</a>. The sanitizer will leave the inner markup inert, but Nokogiri's HTML5 serializer will not escape the > in the attribute value.
3. Submit the payload: Submit the crafted string as user-controlled input (e.g., a comment, search query, or form field) that the application stores or reflects and subsequently passes to highlight or simple_format.
4. Trigger rendering: When the application renders the page containing the helper output, the unescaped > causes the string-processing logic of highlight or simple_format to break the attribute boundary, promoting the previously inert markup into a live HTML element.
5. XSS executes: The victim's browser parses the live element (e.g., <img onerror=alert(1)>), executing the attacker's JavaScript payload in the victim's session context (GitHub Advisory).

The primary fix is to upgrade Rails to version 8.0.5.2 or 8.1.4.1, which enforce a dependency on rails-html-sanitizer >= 1.7.2, which in turn requires Loofah >= 2.25.3 and Nokogiri >= 1.19.5 (Rails 8.0.5.2 Release, Rails 8.1.4.1 Release). If a full Rails upgrade is not immediately possible, two workarounds are available: (1) upgrade Nokogiri independently to version 1.19.5 or later, as the escaping fix resides in its HTML5 serializer; or (2) switch to the HTML4 sanitizer by setting config.action_view.sanitizer_vendor = Rails::HTML4::Sanitizer in your application configuration, which already escapes < and > in attribute values (GitHub Advisory). Patch files for those who cannot upgrade immediately are available for Rails 8.0 and 8.1 respectively (Patch Commit 8.0, Patch Commit 8.1).

The vulnerability was responsibly disclosed through GitHub's security advisory process and credited to HackerOne researcher azaran, as well as the Anthropic OSS Scanner. The fix was authored by Mike Dalessio (flavorjones) of the Rails core team and released as part of a broader security patch batch in Rails 8.0.5.2 and 8.1.4.1 (GitHub Advisory). No significant independent researcher commentary or broad media coverage has been identified beyond the official advisory.