CVE-2026-33167: 
Ruby vulnerability analysis and mitigation

CVE-2026-33167 is a Cross-Site Scripting (XSS) vulnerability in the Action Pack component of Ruby on Rails, specifically in the debug exceptions page. The debug exceptions page fails to properly escape exception messages, allowing a carefully crafted exception message to inject arbitrary HTML and JavaScript into the rendered page. This vulnerability affects Rails versions >= 8.1.0 and < 8.1.2.1, and was disclosed on March 23, 2026, following responsible disclosure by HackerOne researcher fbettag. It carries a CVSS v3.1 base score of 5.4 (Medium) and a CVSS v4.0 base score of 1.3 (Low) (Github Advisory, Rails Release).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically in the layout.erb template of the ActionDispatch::DebugExceptions middleware. The exception message was rendered using Rails' raw helper inside a <script type="text/plain"> tag, bypassing HTML escaping and allowing unfiltered content to be written directly to the page. The fix, committed in 6752711, replaces raw @exception_message_for_copy with standard ERB escaping. Exploitation requires that the application has config.consider_all_requests_local = true (the default in development mode) and that an attacker can influence the content of an exception message (Github Advisory, Rails Commit).

Successful exploitation allows an attacker to inject and execute arbitrary JavaScript in the browser of a user viewing the debug exceptions page, enabling session hijacking, credential theft, or malicious redirects. The impact is primarily limited to confidentiality and integrity of the subsequent (browser) system, with no direct availability impact. Because the vulnerable page is only rendered when config.consider_all_requests_local = true — the default in development environments — production deployments are generally not affected unless this setting has been explicitly enabled (Github Advisory, Red Hat Bugzilla).

No public exploit code or in-the-wild exploitation has been reported for CVE-2026-33167. The EPSS score is approximately 0.015–0.022%, placing it in the 6th percentile for exploitation likelihood. The CVSSv4 exploit maturity is rated "UNREPORTED," and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is constrained by the requirement for user interaction (a victim must view the debug page) and the typical restriction of the vulnerable configuration to development environments (Github Advisory).

1. Identify a target: Locate a Rails 8.1.x application (versions >= 8.1.0, < 8.1.2.1) running with config.consider_all_requests_local = true enabled — typically a development server accessible over a network.
2. Craft a malicious exception message: Identify an application endpoint where attacker-controlled input can influence an exception message (e.g., via a parameter that is passed to a method that raises an exception with the input in its message).
3. Inject HTML/JavaScript payload: Craft a request that causes the application to raise an exception whose message contains a malicious payload, such as <script>alert(1)</script> or a more sophisticated payload for session theft.
4. Trigger the debug exceptions page: Send the crafted request to the target application, causing it to render the debug exceptions page with the unescaped exception message embedded in the page's <script> block.
5. Deliver to victim: Trick a developer or privileged user into visiting the URL that triggers the exception (e.g., via a phishing link), causing the injected JavaScript to execute in their browser context (Github Advisory, Rails Commit).

• Network: Unusual HTTP requests to application endpoints containing HTML or JavaScript characters (e.g., <script>, alert(, onerror=) in parameters that may be reflected in exception messages.
• Logs: Application error logs showing exceptions raised with messages containing HTML tags or JavaScript snippets; web server access logs showing requests with encoded HTML entities (%3Cscript%3E, %3C%2Fscript%3E) in query strings or POST bodies.
• Application Behavior: Unexpected rendering of the Rails debug exceptions page in environments where it should not be accessible; reports from developers of unexpected JavaScript execution when viewing error pages.

The primary remediation is to upgrade the actionpack gem to version 8.1.2.1 or later, which replaces the unsafe raw output with standard ERB HTML escaping (Rails Release). As a workaround, ensure config.consider_all_requests_local is set to false in any environment accessible to untrusted users — this is already the default in production. Organizations using Rails 7.x are not affected by this specific CVE, but should review their own debug exception configurations (Github Advisory, Red Hat Bugzilla).

The vulnerability was responsibly disclosed by HackerOne researcher fbettag and patched by Rails core team member John Hawthorn (jhawthorn) as part of the Rails 8.1.2.1 security release on March 23, 2026, which also addressed six other CVEs. The Rails blog announced the release, and the community response was generally low-key given the limited scope (development environments only) and low severity rating (Rails Release).